Dial-up IPsec VPN Required Settings on FortiGate
An administrator is configuring a dial-up IPsec VPN for remote users. Which TWO settings are required on the FortiGate for the dial-up server? (Choose two.)
Quick Answer
The answer is setting the 'peer type' to 'any' on Phase 1 and using an IP pool for address assignment. These two settings are required because a dial-up IPsec VPN server on FortiGate must accept connections from multiple unknown remote peers, which is achieved by configuring the Phase 1 interface with 'peer type any' to allow dynamic peer identification, while an IP pool provides the necessary IP addresses to remote clients when using mode-config. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this question tests your understanding of dial-up server prerequisites versus site-to-site configurations, where a common trap is confusing static peer settings with the dynamic 'any' requirement. Remember that for dial-up, the Phase 2 selector must also be set to 0.0.0.0/0 to match any destination, but the two required settings from the options are the peer type and the IP pool. A useful memory tip: "Dial-up demands dynamic—peer any and pool ready."
⚠ Common exam trap
It's easy for candidates to confuse 'aggressive mode' as a requirement for dial-up VPNs because it is commonly used with pre-shared keys and dynamic peers, but FortiGate does not require it; the mandatory settings are mode-cfg and peer type any.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set 'mode-cfg' to enable on Phase 1
'mode-cfg' (Mode Config) enables the FortiGate to assign IP addresses and other network settings to remote VPN clients dynamically, which is essential for a dial-up IPsec VPN server. Option B is correct because setting 'peer type' to 'any' allows the FortiGate to accept connections from any remote peer without predefining a specific peer IP, which is required for a dial-up scenario where remote users have dynamic IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set 'mode-cfg' to enable on Phase 1
Why this is correct
Mode-config is used to assign IP addresses to clients.
- ✓
Set 'peer type' to 'any' on Phase 1
Why this is correct
Allows any remote peer to initiate the tunnel.
- ✗
Set 'aggressive mode' on Phase 1
Why it's wrong here
Aggressive mode is often used but not strictly required; main mode with mode-cfg works.
- ✗
Set 'auto-negotiate' to enable on Phase 2
Why it's wrong here
Auto-negotiate is not a standard parameter.
- ✗
Set 'pfs' to enable on Phase 2
Why it's wrong here
PFS is optional and not required for dial-up.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is configuring a dialup IPsec VPN for remote users. Which two settings must be configured on the FortiGate to allow clients to connect?
easy- A.Enable XAuth for user authentication.
- B.Enable Dead Peer Detection.
- ✓ C.Enable mode-cfg on the Phase 1 interface.
- D.Enable NAT traversal.
- ✓ E.Create an IP pool for the remote clients.
Why C: Mode-config (mode-cfg) on the Phase 1 interface is required to push network configuration parameters (such as DNS, WINS, and the virtual IP address) to remote IPsec VPN clients. This setting enables the FortiGate to act as a server in a dialup VPN scenario, dynamically assigning IP addresses and other settings to clients without requiring static configuration on each client.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.