KNOWLEDGE CENTER · FORTIGATE VPN

FortiGate IPsec VPN Setup: IKEv2 Settings with FortiClient

Quad Bilişim · Publishing account: admin · 5 November 2026

To set up remote-access VPN on FortiGate, first match the FortiOS and FortiClient versions, then configure the IKEv2 tunnel, user authentication, client IP pool and a security policy allowing only necessary resources. This guide follows the FortiOS 7.4.9 administration documentation; menus and options may differ in other versions. Site-to-site VPN and the device’s initial internet setup are separate topics.

An expert’s hands reviewing VPN settings at a bright desk with two laptops and an unbranded network security appliance

1. Identify the version: why does IKEv2 matter?

FortiClient Windows 7.4.4 removed IKEv1 support for IPsec. Following an old IKEv1 recipe with this client can cause connection failures. From FortiOS 7.6.3, SSL VPN tunnel mode is replaced by IPsec on all FortiGate models; previous tunnel-mode settings are not carried over during upgrade. Complete migration before upgrading. Do not interpret this as all SSL VPN functions being removed identically in every 7.6 release.

For initial WAN, LAN and administrator access, see the FortiGate basic setup guide . This guide focuses on an authorized user connecting to the office network from outside.

2. Prepare the IP plan and user group

Back up the configuration and record the model, FortiOS build, client operating system and FortiClient version. Under User & Authentication, prepare the group allowed to use VPN. If using LDAP/RADIUS, verify directory connectivity and group matching before configuring VPN; distinguish user authentication from device PSK or certificate authentication. Separately design the organization’s supported multifactor authentication method.

The addresses below are hypothetical. The VPN pool must not overlap the office, branch or remote user’s local network. Do not put passwords or the shared key in this record.

Field	Example	Setup decision
Internal network	10.40.10.0/24	Explicitly restrict the subnet that may be accessed.
VPN pool	10.40.250.10–10.40.250.50	Allocate nonoverlapping client addresses.
Remote gateway	vpn.example.com	Use your own domain name resolving to the actual WAN address.
Group and DNS	VPN-Office / corporate DNS	Record the permitted group and the DNS server resolving internal names.

3. Create the tunnel with IPsec Wizard

Under VPN → IPsec Wizard, select Remote Access and Client-based → FortiClient. Give the tunnel a distinctive name. Set Incoming Interface to the actual WAN interface and select the organization’s PSK or certificate method under Authentication. If using PSK, distribute a long, random, unique key through a secure channel.

In Policy & Routing, enter the internal interface, destination address object and client pool. With split tunneling enabled, only specified corporate networks are routed through the tunnel; routing all internet traffic requires a separate internet access policy and capacity plan. Select reachable corporate DNS for internal names. Review the policies generated by the wizard before saving.

4. Complete IKEv2, EAP and the access policy

Because the wizard workflow documented for 7.4.9 may start with IKEv1, inspect the resulting tunnel; complete conversion to IKEv2 and EAP user authentication using the official instructions for that release. A single group can be defined in the tunnel with authusrgrp; if inheriting groups from policies, add the relevant group to the Firewall Policy source field. Verify group matching separately in a multigroup design. Do not assume changing only the IKE version preserves the user group.

Under Policy & Objects → Firewall Policy, restrict the source pool, chosen group method, destination addresses and required services in the VPN-interface-to-LAN/VLAN policy. Do not leave permanent ALL/ALL permissions just to make a connection work. Decide NAT together with the return route; standard routed internal access usually does not need NAT. Phase 1/2 proposals, DH/PFS and lifetimes must match at both ends.

5. Match the FortiClient profile

In the FortiClient or EMS remote-access profile, select IPsec VPN, the actual Remote Gateway and IKE Version 2. PSK/certificate method, user authentication, Mode Config address assignment, Phase 1/2 and transport options must match FortiGate. Do not assume an EMS-managed client and the free VPN client have identical menus and features; check the installed version and package support.

For a setup starting with UDP, verify network access required for IKE and NAT-T. IPsec over TCP/443 or UDP-to-TCP fallback requires support and matching transport modes at both ends. The FortiOS 7.4.9 documentation warns that TCP/443 may conflict with HTTPS management access. Check existing services and administrator access before changing ports; selecting TCP/443 alone does not guarantee connectivity.

6. Connected but cannot reach the internal network: what to check

A connected VPN status does not mean application access is complete. First inspect Phase 1 and Phase 2 in the IPsec view under Dashboard → Network. Then check the client’s assigned IP, route to the destination, policy match, return route and the server’s own firewall. If access by IP works but access by name fails, investigate DNS. Ping may be blocked; also try the actual permitted application port.

With an authorized user, verify both access to permitted resources and blocking of prohibited resources. Record the date, versions, destination service, policy ID and outcome. This article does not claim testing in a real customer environment. Full diagnostic outputs may contain session keys or user information; redact confidential fields before sharing.

Clarify the scope of your FortiGate VPN setup

FortiGate support service — share the device model, software version, client count and applications that need access. Also review licensing and support duration using the FortiGate licensing checklist . Versions shown here illustrate the interface; check currently supported releases and security advisories before deployment.

Technical resources

Sources checked: 5 November 2026. The assessment table, steps and hypothetical example are original working suggestions by Quad Bilişim; they are not a price or outcome guarantee.