Mode-Configuration
When IKE Mode-Configuration is enabled, multiple server IPs can be defined in IPsec Phase 1. This mode also allows IP information to be sent the client if attribute 28681 is requested.
Mode-Configuration is configured through the CLI. An example of a complete configuration is shown below:
config vpn ipsec phase1-interface
edit "vpn-p1"
set type dynamic
set interface "wan1"
set xauthtype auto
set mode aggressive
set mode-cfg enable
set proposal 3des-sha1 aes128-sha1
set dpd disable
set dhgrp 2
set xauthexpire on-rekey
set authusrgrp "FG-Group1"
set ipv4-start-ip 10.10.10.10
set ipv4-end-ip 10.10.10.20
set ipv4-dns-server1 1.1.1.1
set ipv4-dns-server2 2.2.2.2
set ipv4-dns-server3 3.3.3.3
set ipv4-wins-server1 4.4.4.4
set ipv4-wins-server2 5.5.5.5
set domain "fgt1c-domain"
set banner "fgt111C-banner"
set backup-gateway "100.100.100.1" "100.100.100.2" "host1.com" "host2"
end
end