Enable PPTP VPN on FortiOS 4.x

This tutorial is to show you how to enable PPTP VPN feature on Fortigate devices running FortiOS 4.0+.

After upgrading your Fortibox to the OS 4.0, the theme color changed (too visual, right), and the VPN PPTP for clients is gone. There is no PPTP option in the VPN section (GUI interface).

This is what you don’t want because there are so many existing remote users who need PPTP VPN to connect to work. With PPTP, Windows users, Linux users, and MacOS users could easily create a VPN connections and connect to the corporate network.

To enable PPTP VPN on Fortigate OS 4.0, you must enable it using CLI (Command line interface). CLI connection to a Fortigate device could be established by Serial Port, Telnet, or SSH. Telnet is less secure than SSH because Telnet is sending everything in plain text, even your password.

To successfully connect to VPN using PPTP, end users must have a valid credentials (username and password). The account could be on local Fortigate database or Active Directory. In this tutorial, I assume that you are going to use local user database to authenticate VPN users.

Create new user account

Follow these steps while you are in SSH session to create a user account:

FORTIGATEW01 # config user local
FORTIGATEW01 (local) # edit vpn_client01
new entry ‘vpn_client01' added
FORTIGATEW01 (vpn_client01) # set status enable
FORTIGATEW01 (vpn_client01) # set type password
FORTIGATEW01 (vpn_client01) # set passwd vpn_password01 
FORTIGATEW01 (vpn_client01) # end

Create group for VPN PPTP

Follow these steps to create a new group, add member to this group, set type of this group to use for VPN authentication:

FORTIGATEW01 # config user group
FORTIGATEW01 (group) # edit VPN-Users
FORTIGATEW01 (VPN-Users) # set member vpn_client01
FORTIGATEW01 (VPN-Users) # set group-type firewall

Enabling and configuring PPTP VPN

To enable PPTP VPN on FortiOS 4.x, follow these steps:

FORTIGATEW01 (pptp) # config vpn pptp
FORTIGATEW01 (pptp) # set sip 192.168.220.160
FORTIGATEW01 (pptp) # set eip 192.168.220.170
FORTIGATEW01 (pptp) # set ip-mode range
FORTIGATEW01 (pptp) # set status enable
FORTIGATEW01 (pptp) # set usrgrp VPN-Users
FORTIGATEW01 (pptp) # end

“sip” and “eip” are the IP range of LOCAL NETWORK that you want to assign to PPTP VPN clients.

set ip-mode range is to tell Fortinet to use the sip and eip defined above.

set usrgrp VPN-Users – Here is what we configured above. The group name VPN-Users we just created is added to PPTP VPN settings. vpn_client01, as a VPN-Clients group member, is now able to connect to the box using PPTP VPN.

Now, your box is ready to accept PPTP requests from client, but you need to remember to add this range-ip to Policy because without this you can connect to PPTP VPN but you cannot access any ip inside the network.

For do this, you have to go to Policy -> Policy -> New:

Source Interface: wan
Source Address: 192.168.220.[160-169]
Destination Interface: internal
Destination Address: All
Schedule: Always
Service: ANY (here you can modify services for accept only some type of service)
Action: ACCEPT 

And if you want to try if PPTP works, you can enable “L2TP/PPTP/PPPoE service event” in Log&Report->Log Config->Log Setting and see what happen in Log&Report->Log & Archive Access -> Event Log when you try to access from a client.