Dial-Up IPsec VPN: Configure for Users with Dynamic IP Addresses
An admin is configuring a dial-up IPsec VPN for remote users. The users will connect from various public IP addresses. Which Phase 1 configuration is required for the FortiGate to accept connections from unknown remote gateways?
⚠ Common exam trap
Candidates often confuse the need for aggressive mode (option A) with the requirement to accept unknown remote gateways, but aggressive mode is about identity protection and faster negotiation, not about allowing any source IP to initiate the tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the remote gateway to 0.0.0.0
For a dial-up IPsec VPN where remote users connect from dynamic public IP addresses, the FortiGate must be configured to accept connections from any remote gateway. Setting the remote gateway to 0.0.0.0 (or 0.0.0.0/0) in Phase 1 tells the FortiGate to accept IKE negotiation from any source IP, which is essential for dial-up scenarios. This is the standard method to allow unknown remote gateways to initiate the VPN tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable aggressive mode
Why it's wrong here
Enabling aggressive mode changes the Phase 1 IKE exchange to send identity and pre-shared-key hashes in fewer packets, which can help when clients have dynamic IPs, but it is not a mandatory setting for dialup IPsec. FortiGate dialup Phase 1 configurations also support main mode, since the remote gateway wildcard 0.0.0.0 lets the responder accept any initiator and learn the peer's IP from the IKE source address. Thus, aggressive mode is an optional tunable, not a prerequisite for a dialup VPN.
- ✓
Set the remote gateway to 0.0.0.0
Why this is correct
Setting the remote gateway to 0.0.0.0 is the core dialup Phase 1 setting on a FortiGate: it instructs the device to accept incoming IKE connections from any source IP address rather than from one fixed peer. This wildcard is what enables remote users with dynamic public IPs to build a tunnel, because the actual peer address is learned automatically when the client initiates Phase 1 negotiation. Combined with peer type 'one', this makes the FortiGate operate as the dialup VPN server.
- ✗
Configure a static route to the remote users' subnet
Why it's wrong here
A static route to the remote users' subnet is not part of Phase 1 configuration and cannot be predefined, because dialup remote users typically receive an IP address from a dynamically assigned pool via mode-config after the tunnel is up. In route-based IPsec, a static route is added pointing to the local tunnel interface—never to the remote gateway—and a dialup setup deliberately avoids hard-coding remote subnets that are unknown until connection time. Therefore, this option is outside the scope of dialup Phase 1 and is not a valid prerequisite.
- ✗
Set the remote gateway to a specific IP address
Why it's wrong here
Setting the remote gateway to a specific IP address would force the dialup VPN to accept connections only from that exact source IP, which defeats the purpose of a dialup VPN for mobile or remote users whose addresses frequently change. The FortiGate uses 0.0.0.0 as a wildcard specifically to avoid this restriction; a specific IP is appropriate for a fixed site-to-site tunnel, not a dialup server that must serve an arbitrary set of clients. This option would break dialup connectivity rather than enable it.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.