Fortigate IPSec VPN client for iPhone with two different groups

In the following post I will describe how to configure Fortigate IPSec VPN for iPhone clients with 2 different authentication groups.

For this post I used Fortigate FGT60B with FortiOS v4.0, build0521, 120313 (MR3 Patch 6).

1.       Create user account:

CLI config:

config user local    edit "test1"       set status enable       set type password       set passwd <password> end

 

2.       Create group:

 

 

 CLI config:

config user group    edit "TEST-GRP-1"       set member "test1" end

 

3.       Create firewall address objects for VPN clients network:

In my example the VPN clients will be part of network 10.10.11.0/24

CLI config:

config firewall address    edit TEST1-NETWORK       set subnet <ip here subnet here> (ie: 10.10.11.0 255.255.255.0)    next

 

4.       Create firewall address object for internal network (if you don’t already have one):

Here I use network 192.168.10.0/24 as my internal network

CLI config:

config firewall address    edit LAN       set subnet <ip here subnet here> (ie: 192.168.10.0 255.255.255.0)    next

 

5.       Now we will configure IPSec phase-1 and phase-2, both will have to be configured from the CLI because some options are missing in the web GUI.

 

config vpn ipsec phase1-interface     edit "TEST1-PH1"         set type dynamic         set interface "wan1"         set dhgrp 2         set peertype one         set xauthtype auto         set mode aggressive         set mode-cfg enable         set proposal aes256-md5 aes256-sha1         set peerid "test1"         set authusrgrp "TEST-GRP-1"         set ipv4-start-ip 10.10.11.1         set ipv4-end-ip 10.10.11.254         set ipv4-netmask 255.255.255.0         set psksecret <tunnel password here> end

 6.       Phase-2 configuration:

config vpn ipsec phase2-interface     edit " TEST1-PH2"         set keepalive enable         set pfs disable         set phase1name " TEST1-PH1"         set proposal aes256-md5 aes256-sha1 end

 7.       Configure firewall policy rule which allow access from VPN client network to internal network

 

 CLI config:

config firewall policy     edit <unique firewall policy ID here>         set srcintf "TEST1-PH1"         set dstintf "internal"         set srcaddr "TEST1-NETWORK"         set dstaddr "LAN"         set action accept         set schedule "always"         set service "ANY"     next

 

8.       Configure firewall policy rule which allow access from internal network to VPN client network

CLI config:

config firewall policy     edit <unique firewall policy ID here>         set srcintf "internal"         set dstintf "TEST1-PH1"         set srcaddr "LAN"         set dstaddr "TEST1-NETWORK"         set action accept         set schedule "always"         set service "ANY"     next

9.       Configure static route with VPN clients network as destination and IPSec phase-1 as next-hop

 

 CLI config:

config router static         edit <unique route ID>         set device "TEST1-PH1"         set dst 10.10.11.0 255.255.255.0 end

 

10.   Configure iPhone VPN client, go to Settings -> General -> Network -> VPN and click on Add VPN Configuration…

11.   Choose IPSec and fill the required information below:

Description	Short quick description of the VPN
Server	WAN IP address of the FGT unit
Account	User name
Password	Password of the user
Group name	Peer id value which was configured on step 5
Secret	PSK value which was configured on step 5

 

12.   Now slide the VPN button and connect to your network using IPSec

 

 13.   Repeat steps 1 to 12 to configure another account with different group, note that the peer ID value is responsible for differentiate each group.