How to reserve IP addresses for FortiClient dial-in users when DHCP-over-IPSec is used

‎09-06-2005

Article

Description How to reserve IP addresses for FortiClient dial-in users when using DHCP-over-IPSec.

Components

All Fortigate models with v2.80
FortiClient v1.2, v1.6, v2.0

Steps or Commands

You can reserve dedicated IP addresses for FortiClient dial-in users when the "Acquire virtual IP address" method is configured for DHCP-over-IPSec. You can configure this for some or all of the FortiClient dial-in users.

This provides:

better traceability of internal servers' logs.
restricted control access to certain 'controlled' IP addresses on internal servers.

To do this, configure the internal DHCP server (not on the FortiGate unit) to bind an IP addresse to a client's MAC address. Use the MAC address of the physical network interface card on the PC with FortiClient installed and will be connecting to the FortiGate unit.

You can obtain the PC's MAC address by running ipconfig/all from within a DOS command prompt. Use the network interface MAC address used for Internet access.

Note that you do not have to configure on the FortiGate unit, as this is a built-in feature of the DHCP protocol itself.

Tip: When you add/define a new IP reservation on your DHCP server, ensure you delete the active lease for this IP address, so that it can take effect upon next connection. Once the reservation is made on the DHCP server (and the lease cleared for this IP address), the next time the FortiClient dials in, the PC acquires the reserved IP address as an IPSec Virtual IP.

Below is a configuration example of an IP reservation configured on a linux dhcpd server, where IP address 10.100.0.13 is reserved for PC 'trublion' which will VPN dial-in with FortiClient. The internal subnet is 10.100.0.0/24 and addresses from 10.100.0.1 - 10.100.0.31 are assigned through DHCP.

# cat /etc/dhcpd.conf
ddns-update-style interim;
allow unknown-clients;

shared-network labtest {

        subnet 10.100.0.0 netmask 255.255.255.0 {
                range 10.100.0.1 10.100.0.31 ;
                option routers 10.100.0.147 ;
                option broadcast-address 10.100.0.255 ;

                host trublion {
                  hardware ethernet 00:0C:29:C5:F6:67;
                  fixed-address 10.100.0.13;
             }

}