This section describes how to configure a site-to-site VPN, in which one Forti Gate unit has a static IP address and the other Forti Gate unit has a domain name and a dynamic IP address.

The following topics are included in this section: A typical computer has a static IP address and one or more DNS servers to resolve fully qualified domain names (FQDN) into IP addresses.

The Local ID or peer ID can be used to uniquely identify one end of a VPN tunnel. Also if you have multiple VPN tunnels negotiating, this ensures the proper remote and local ends connect.

When you configure it on your end, it is your Local ID.

To avoid this, the remote peer must perform a DNS lookup for the domain name of to be sure of the dynamic IP address before initiating the connection.

When configuring the Phase 1 entry for a VPN tunnel, the Remote Gateway determines the addressing method the remote end of the tunnel uses as one of Static IP Address, Dialup User, or Dynamic DNS. When you select the Dynamic DNS VPN type there is a related field called Dynamic DNS.

However, when the interface the tunnel is on has DDNS enabled there is no set IP address.

The remote end of the VPN tunnel now needs another way to reference your end of the VPN tunnel. A Forti Gate unit that has a domain name and a dynamic IP address can initiate VPN connections anytime.

Computers that want to contact this computer do not know what its current IP address is.

See Dynamic DNS configuration and Dynamic DNS configuration.

Policy-based VPN configuration uses more complex and often more IPsec security policies, but does not require a static route entry.

To use DDNS servers, you must subscribe to them and usually pay for their services.

When configuring DDNS on your Forti Gate unit, go to and enable Enable Forti Guard DDNS.