A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad. Which IPsec Wizard template must the administrator apply?

The Remote Access IPsec wizard template is the correct choice for configuring a VPN for a single, mobile user. This template is specifically designed to create a dial-up IPsec VPN, where the FortiGate acts as a server (responder) and the traveling employee's device, typically using FortiClient, acts as the client (initiator). The client's IP address is expected to be dynamic, which is characteristic of a user traveling and connecting from various locations like hotels or public Wi-Fi. The wizard automates the creation of the necessary Phase 1, Phase 2, user group, and firewall policy settings for this scenario.

B. Site to Site: This template is used to connect two entire networks, such as a main office and a branch office, where both ends are typically gateways with static IP addresses.
C. Dial up User: This is a peer type within the Phase 1 configuration that the "Remote Access" wizard creates, but it is not the name of the wizard template itself.
D. Hub-and-Spoke: This is a topology for connecting multiple remote sites (spokes) to a central location (hub). It is a form of site-to-site VPN, not for individual remote users.

1. Fortinet FortiOS 7.0.1 Administration Guide: In the "IPsec VPN wizards" section, it states, "The IPsec VPN wizard provides templates for creating some of the most common VPN configurations... Remote Access: For remote clients, such as FortiClient, to securely connect to the internal network." (p. 1018).

2. Fortinet Cookbook (docs.fortinet.com): The recipe "IPsec VPN for remote access" for FortiOS 7.0 demonstrates the procedure. Step 1 explicitly instructs the administrator to "Go to VPN > IPsec Wizard and create a new tunnel. Name the tunnel and select the Remote Access template." This confirms the template's purpose is for remote users with FortiClient.