Firewall Support Center
Firewall / Fortigate

How to Configure FortiGate Remote Access IPsec VPN with FortiClient (IKEv2)

By · Updated

Scope: IPv4 remote access with FortiOS 7.6.x and FortiClient 7.4.4 for Windows. This example uses the FortiGate Remote Access wizard, IKEv2, a pre-shared key (PSK), local users authenticated through EAP, and split tunneling. The sample addresses are illustrative. Menu labels and wizard defaults can vary by build.

Use this setup when individual users need to reach an internal network from FortiClient. FortiGate listens for dial-up clients and assigns each connected client a virtual IP address. This example sends only the corporate subnet through the tunnel.

Lab topology and prerequisites

Remote access lab topology
  1. 1. FortiClient
    Windows remote user
    VPN IP: 10.250.40.10–50
  2. 2. FortiGate
    vpn.example.com
    IKEv2 on wan1
  3. 3. Corporate LAN
    10.40.10.0/24
    HTTPS test: 10.40.10.20:443

Packet path: FortiClient → encrypted IPsec tunnel → FortiGate → LAN policy → HTTPS server.

Public gateway: vpn.example.com on wan1. Internal network: 10.40.10.0/24 on lan. Client pool: 10.250.40.10–10.250.40.50 in 10.250.40.0/24. Test server: 10.40.10.20:443.

Use a client pool that does not overlap internal networks or other VPN pools. Choose a test network that does not overlap the corporate subnet. Confirm that the public hostname resolves to the intended WAN address and that the path permits IKE over UDP 500 and NAT-T over UDP 4500 for this UDP-based example. If an upstream device performs NAT, verify that it forwards the required traffic to the FortiGate.

GUI walkthrough at a glance
FortiGate · IPsec Wizard
  1. Remote Access → FortiClient
  2. WAN interface, PSK, pilot user group
  3. LAN subnet, VPN client pool, split tunnel
FortiClient · Remote Access
  1. New connection → IPsec VPN
  2. Gateway FQDN and matching PSK
  3. IKEv2, Mode Config, user sign-in

Match on both sides: IKE version, PSK, and compatible Phase 1 and Phase 2 proposals.

1. Create a pilot user and group

In User & Authentication, create a dedicated local pilot user and add it to a group such as RA-IPSEC-USERS. The user signs in with their own credentials. The PSK is a separate VPN profile secret. Generate a strong PSK and distribute it through an approved secret-sharing channel. Keep the initial rollout limited to the pilot group.

2. Build the FortiGate dial-up tunnel

Open the IPsec VPN Wizard. Choose the Remote Access template and the FortiClient client type. Name the tunnel RA-IKEv2. Select wan1 as the listening interface, enter the PSK, and select RA-IPSEC-USERS. Where the wizard offers an IKE version choice, select IKEv2.

Select lan and an address object for 10.40.10.0/24. Set the VPN client pool to 10.250.40.10–10.250.40.50 with the corresponding mask. Enable IPv4 split tunneling and include the corporate subnet. If internal DNS names are required, configure the appropriate DNS server and make sure it is reachable through the VPN. Save the wizard configuration.

Inspect the resulting Phase 1 settings before distributing the client profile. Verify IKEv2, Mode Config, EAP, and the intended user group association. Confirm that the tunnel proposals and Phase 2 settings have compatible values on the FortiGate and client. FortiClient 7.4.4 does not support IKEv1. Fortinet also documents a FortiOS 7.6.0 wizard issue where EAP and user-group settings may be missing from the generated IKEv2 tunnel. Check your exact build if the group was selected but authentication fails.

3. Review the firewall policy and return path

Review the wizard-generated policy from RA-IKEv2 to lan. For the pilot, limit it to the VPN client pool, the test server, and HTTPS. Enable traffic logging for the test. If the design preserves client addresses, leave source NAT off for this internal policy and verify that the server’s gateway can return traffic to the VPN client pool via FortiGate. This matters when a separate Layer 3 device routes the internal network.

4. Configure the FortiClient profile

In FortiClient, open Remote Access and add an IPsec VPN profile. Set the remote gateway to vpn.example.com, choose Pre-shared Key, and enter the matching PSK. In the advanced settings, choose IKEv2 and Mode Config. Use the option to prompt for user credentials. Match any explicitly configured proposals and identity settings to the FortiGate profile. Save and connect from a network outside the corporate LAN.

5. Verify the tunnel and test an internal application

get vpn ipsec tunnel summary
diagnose vpn tunnel list

On FortiGate, confirm the dial-up tunnel appears and has an IPsec SA. Treat the raw diagnostic output as sensitive because detailed tunnel output can contain key material. On Windows, check the assigned client IP and the route for the corporate subnet. Then test TCP/443 directly against the internal server.

ipconfig
route print -4
Test-NetConnection 10.40.10.20 -Port 443

Run Test-NetConnection in PowerShell. Verify that the client received an IP from the expected pool, the corporate route uses the VPN adapter, and the TCP test succeeds. Test the actual HTTPS application next. If the IP test succeeds but the application hostname fails, check DNS resolution and then the application’s hostname and certificate behavior.

If the test fails, start at the first failed checkpoint

FortiClient cannot connect: check public DNS and WAN reachability, IKE version, PSK, compatible proposals, and EAP authentication. Connected but no client IP: check Mode Config and pool availability. Connected with an IP but no internal access: check the client route, subnet overlap, firewall policy logs, and the return route. Only hostnames fail: verify internal DNS reachability and name resolution.

Fortinet references and related guide

FortiClient dial-up configuration on FortiGate · FortiClient 7.4.4 IPsec feature comparison · IKEv2 and EAP configuration · FortiOS 7.6.0 wizard issue

Troubleshooting a tunnel between two gateways? See FortiGate IPsec VPN Is Up but No Traffic Passes.