Dial-Up IPsec VPN: Configure for Users with Dynamic IP Addresses
A FortiGate admin is configuring a dial-up IPsec VPN for remote users. The users have dynamic IP addresses. Which Phase 1 configuration is appropriate?
Quick Answer
The answer is to set the remote gateway to 'Dialup User' and enable an IP pool. This configuration is correct because when remote users connect with dynamic IP addresses, the FortiGate cannot know their IP in advance, so the Phase 1 interface must be set to accept connections from any source by selecting 'Dialup User' as the remote gateway. An IP pool is then required to assign a static virtual IP from a defined range to each authenticated client, ensuring proper routing and network access for the dial-up IPsec VPN. On the Fortinet NSE 4 exam, this scenario tests your understanding of Phase 1 settings for dynamic IP scenarios, often appearing as a multiple-choice question where distractors include setting a static peer ID or using a fixed remote gateway. A common trap is confusing 'Dialup User' with 'Pre-shared Key' authentication—remember that 'Dialup User' is a gateway type, not an authentication method. Memory tip: "Dynamic dial-up demands a dial-up gateway and a pool to play."
⚠ Common exam trap
Test-takers frequently confuse 'Dialup User' with a static remote gateway setting, or they mistakenly think aggressive mode is required for dynamic IPs, when in fact FortiGate dial-up VPNs use main mode by default and the 'Dialup User' option handles dynamic peers transparently.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the remote gateway to 'Dialup User' and enable an IP pool
For dial-up IPsec VPNs where remote users have dynamic IP addresses, the FortiGate cannot know the remote gateway IP in advance. Setting the remote gateway to 'Dialup User' allows the FortiGate to accept connections from any IP, and enabling an IP pool assigns a static internal IP to the remote user for routing and policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the remote gateway to 'Dialup User' and enable an IP pool
Why this is correct
This allows any remote user to connect and get an IP from the pool.
- ✗
Disable XAuth authentication
Why it's wrong here
XAuth can be used for additional user authentication but not the primary setting.
- ✗
Set the remote gateway to the user's IP address
Why it's wrong here
Not possible with dynamic IPs.
- ✗
Use aggressive mode with a group pre-shared key
Why it's wrong here
Aggressive mode can be used but is less secure; the key point is dialup configuration.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An admin is configuring a dial-up IPsec VPN for remote users. The users will connect from various public IP addresses. Which Phase 1 configuration is required for the FortiGate to accept connections from unknown remote gateways?
medium- A.Enable aggressive mode
- ✓ B.Set the remote gateway to 0.0.0.0
- C.Configure a static route to the remote users' subnet
- D.Set the remote gateway to a specific IP address
Why B: For a dial-up IPsec VPN where remote users connect from dynamic public IP addresses, the FortiGate must be configured to accept connections from any remote gateway. Setting the remote gateway to 0.0.0.0 (or 0.0.0.0/0) in Phase 1 tells the FortiGate to accept IKE negotiation from any source IP, which is essential for dial-up scenarios. This is the standard method to allow unknown remote gateways to initiate the VPN tunnel.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.