fortigate-ipsec-40-mr3

Dynamic DNS configuration Configure the dynamically-addressed VPN peer
6 Optionally configure any other security policy settings you require such as UTM or
traffic shaping for this policy.
7 Place these policies in the policy list above any other policies having similar source
and destination addresses. This will ensure VPN traffic is matched against the VPN
policies before any other policies.
To create routing entry for VPN interface - CLI
config router static
edit 5
set dst 0.0.0.0 0.0.0.0
set dynamic-dateway enable
set device wan1
next
end
This routing entry must be added in the CLI because the dynamic-gateway option is not
available in the web-based manager.
Creating branch_2 policy-based security policies
Define an IPsec policy to permit VPN sessions between the private networks.
1 Go to Policy > Policy > Policy.
2 Select Create New.
Define an IPsec policy to permit the VPN sessions between the local branch_2 unit
and the remote branch_1 unit.
3 Enter the following information, and select OK.
Select internal.
Source Interface/Zone The interface connecting the private network behind this
FortiGate unit.
Select branch_2_internal.
Source Address Name The address name for the private network behind this local
FortiGate unit.
Destination
Interface/Zone
Select wan1.
The FortiGate unit’s public interface.
Destination Address
Name
Select branch_1_internal.
The address name for the private network behind branch_1,
the remote peer.
Action Select IPSEC.
VPN Tunnel
Allow Inbound
Allow Outbound
Comment
Select branch_2
The name of the phase 1 tunnel.
Select both Allow inbound and Allow outbound to enable
traffic from either direction to initiate the tunnel.
If you have problems connecting, try enabling NAT.
policy-based: allows traffic in either direction to initiate the
VPN tunnel.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 109
http://docs.fortinet.com/