Chapter 3 Authentication for FortiOS 5.0 : Introduction to authentication : Types of authentication : VPN authentication : Authenticating IPsec VPN users
  
Authenticating IPsec VPN users
An IPsec VPN can be configured to accept connections from multiple dynamically addressed peers. You would do this to enable employees to connect to the corporate network while traveling or from home. On a FortiGate unit, you create this configuration by setting the Remote Gateway to Dialup User.
It is possible to have an IPsec VPN in which remote peer devices authenticate using a common preshared key or a certificate, but there is no attempt to identify the user at the remote peer. To add user authentication, you can do one of the following:
require a unique preshared key for each peer
require a unique peer ID for each peer
require a unique peer certificate for each peer
require additional user authentication (XAuth)
The peer ID is a text string configured on the peer device. On a FortiGate peer or FortiClient Endpoint Security peer, the peer ID provided to the remote peer is called the Local ID.