fortigate-ipsec-40-mr3

Dynamic DNS configuration Configure the dynamically-addressed VPN peer
Define address ranges for branch_2 security policies
Define VPN connection names for the address ranges of the private networks. These
addresses are used in the security policies that permit communication between the
networks. For more information, see “Defining policy addresses” on page 63.
Define an address name for the IP address and netmask of the private network behind
the local FortiGate unit.
To define branch_2 address ranges
1 Go to Firewall Objects > Address > Address.
2 Select Create New.
3 Enter the following information, and select OK.
Address Name Enter branch_2_internal. Enter a meaningful name.
Type Subnet/IP Range.
Subnet / IP Range 10.10.10.0/24
Include the netmask or specify a specific range.
Interface
internal
The interface that will be handling the traffic from the internal
network.
Define an address name for the IP address and netmask of the private network behind
the remote peer.
4 Select Create New.
5 Enter the following information, and select OK.
Enter branch_1_internal.
Address Name A meaningful name for the private network at the remote end of the
VPN tunnel.
Type Subnet/IP Range.
Subnet / IP Range 192.168.1.0/24
Include the netmask. Optionally you can specify a range.
Interface
any
The interface that will be handling the remote VPN traffic on this
FortiGate unit.
If you are unsure, or multiple interfaces may be handling this traffic
use any.
Creating branch_2 route-based security policies
Define ACCEPT security policies to permit communication between the branch_2 and
branch_1 private networks.
Once the route-based policy is configured a routing entry must be configured to route
traffic over the VPN interface.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 107
http://docs.fortinet.com/