Dial-up IPsec VPN Required Settings on FortiGate
An administrator is configuring a dialup IPsec VPN for remote users. Which two settings must be configured on the FortiGate to allow clients to connect?
⚠ Common exam trap
It's easy for candidates to assume XAuth or NAT traversal are mandatory for dialup IPsec, but the FortiGate specifically requires mode-cfg and an IP pool to dynamically assign client addresses and complete the tunnel setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable mode-cfg on the Phase 1 interface.
Mode-config (mode-cfg) on the Phase 1 interface is required to push network configuration parameters (such as DNS, WINS, and the virtual IP address) to remote IPsec VPN clients. This setting enables the FortiGate to act as a server in a dialup VPN scenario, dynamically assigning IP addresses and other settings to clients without requiring static configuration on each client.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable XAuth for user authentication.
Why it's wrong here
XAuth provides an additional user authentication step after IKE Phase 1, but it does not allocate tunnel addresses or send down DNS/WINS settings. For basic dialup IPsec connectivity, the gateway only needs a Phase 1 proposal (e.g., PSK/certificates) and Phase 2 proxy IDs; XAuth is optional. Omitting XAuth does not prevent remote clients from establishing a tunnel if mode-cfg and an IP pool are correctly configured.
- ✗
Enable Dead Peer Detection.
Why it's wrong here
Dead Peer Detection is a keepalive mechanism that detects when the remote peer becomes unreachable, allowing the gateway to expire idle security associations. It is a reliability enhancement, not a provisioning step, and does not affect whether a client receives an IP address or can connect. If DPD is disabled, the VPN still works, though stale SAs may linger longer.
- ✓
Enable mode-cfg on the Phase 1 interface.
Why this is correct
Enabling mode-cfg on the Phase 1 interface is the direct mechanism by which the FortiGate pushes the client configuration back to the dialup peer. This configuration includes the assigned IPv4 address, DNS server, WINS server, and sometimes split-tunnel settings. Without mode-cfg, a remote client has no tunnel IP and cannot route traffic through the VPN, so it is a mandatory component for dialup deployments. In FortiOS, mode-cfg references an IP pool to source the addresses.
- ✗
Enable NAT traversal.
Why it's wrong here
NAT traversal is needed only when the remote client is behind a NAT device that changes the UDP source port or address of IKE packets. With direct Internet connections, NAT-T is not required, so enabling it does not guarantee client addressing or configuration. The absence of NAT-T does not block a dialup client that is not behind NAT, and its presence does not replace the need for mode-cfg.
- ✓
Create an IP pool for the remote clients.
Why this is correct
An IP pool defines the subnet and range of addresses from which dialup clients are assigned their virtual tunnel IP. Without a defined pool, mode-cfg has no addresses to hand out, and the client cannot participate in IP routing. Creating a pool is therefore just as essential as enabling mode-cfg; the two work together in FortiOS to provision the client’s logical interface.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.