roaming (NAT-T) IPSec client to Fortigate 100D IPSec peer

RouterOS General
1

Hi folks,

We have about 5 IPSec tunnels from static (non-NAT-T) MikroTik routers to our Fortigate 100D at headoffice.
I have to battle a challenge where I have a MT RB951G-2HnD in a private network with a non-static IP establish an IPSec VPN tunnel to our Fortigate 100D.

So far I have ended up with Fortigte support pointing at MT to get this resolved. Though I am suspicious that it mit not be on the MT side at all, I wonder if anyone has already conquered this challenge .. and won?
the IPSec dialup interface on the Fortigate shows in its IPSec monitor the status as N/A .
I am not asking for help on the fortigate side, but if someone has/had this up and running.

The purpose is solely for remote management of the MT, and hotspot AAA via Radius against a server in 192.168.120.0/26.
Clients in the 192.168.144.128/27 network shall not be able to send any traffic through the IPSec tunnel.

Cheers,
Stefan
MT-FGT.png

2

got it sorted. All handshakes should Be set to DH2 (1024) and in MT’s policy definition the ip address of the uplink/gw interface should be entered. Regardless that it might change and is a non-routeable IP.

All up and running now.