Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to configure a VPN for secure remote access to a PACS serving DICOM radiological images. The DICOM standard requires that any clients accessing the PACS must be using a fixed IP address that is pre-registered in PACS. I haven't implemented this solution before and would appreciate any guidance. I believe it should be possible to use RADIUS on the server to authenticate users connecting to the VPN and with it assign each user their own specific local subnet IP address, which would be registered with the PACS. The server runs Windows Server 2003 R2 Enterprise Edition SP2 and the VPN device is a FortiGate 60C. The What would be the best and/or simplest way to set this up?

share|improve this question

Does the FortiGate allow for the VPN client to specify it's own ip address? If so, turn that option on and manually configure each VPN client with the appropriate ip address.

This is easily achievable with a Windows RRAS server as the VPN server.

share|improve this answer
I ran into some snags with Astaro/RADIUS and assigning static IPs. Normally with PPTP/RRAS, you can allow Dial-In privileges and assign a static IP on the AD user's properties, but with IAS/RADIUS, I had to create a stub VPN group for each user that needed a static IP, create a Remote Access Policy that then matched on that NT group (no condition option for users, only groups), and apply the static IP accordingly. This was on W2K3, might be different now with NPS. – gravyface Feb 23 '11 at 14:24
Thanks for the suggestion, joeqwerty. Never considered something as simple as that :-) I haven't had time to test this possibility yet, but it would certainly be the simplest. – Joe Carroll Feb 26 '11 at 18:09
I've checked the FortiGate documentation and couldn't find anything one way or the other regarding clients specifying remote addresses. I chatted with their support but didn't actually get a straight answer to your question. They suggested I use DHCP over IPSec as the FortiGate will allow me to reserve or bind IP addresses using the MAC of the client machine. Again, this will need to be tested to confirm it works as desired, but it seems to be easier to configure than RADIUS (thank you for the tip there, gravyface). I'll update again once I've had a chance to try each option out. – Joe Carroll Feb 26 '11 at 18:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.