fortigate-ipsec-40-mr3

Dynamic DNS configuration Configure the fixed-address VPN peer
Dynamic DNS
4 Define the phase 2 parameters needed to create a VPN tunnel with the remote peer.
See “Phase 2 parameters” on page 57. Enter these settings in particular:
Configuring branch_1 security policies
Type the fully qualified domain name of the remote peer (for
example, example.com).
Enter wan1.
Interface The public facing interface on the fixed-address FortiGate unit.
This interface cannot be a loopback interface.
Mode Select Aggressive.
Peer Options
Advanced
Enable IPsec
Interface Mode
Name
Phase 1
Select Accept this peer ID, and enter example.com. This option
only appears when the mode is set to Aggressive.
The identifier of the FortiGate unit with the dynamic address.
Enable for a route-based VPN and when configuring policies, go to
“Creating branch_1 route-based security policies” on page 112.
Disable for a policy-based VPN and when configuring policies, go
to “Creating branch_1 policy-based security policies” on
page 113.
If Interface mode is enabled, default settings are used.
Enter branch_1_p2.
A name to identify this phase 2 configuration.
Select branch_1.
The name of the phase 1 configuration that you defined for the
remote peer. You can select the name of the remote gateway from
the Dynamic DNS part of the list.
The branch_1 FortiGate unit has a fixed IP address and will be connecting to the
branch_2 FortiGate unit that has a dynamic IP address and a domain name of
example.com.
Remember if you are using route-based security policies that you must add a route for
the VPN traffic.
Defining address ranges for branch_1 security policies
As with branch_2 previously, branch_1 needs address ranges defined as well. See
“Defining policy addresses” on page 63.
1 Go to Firewall Objects > Address > Address.
2 Select Create New.
3 Enter the following information, and select OK.
Enter branch_2_internal.
Address Name A meaningful name for the private network behind the branch_2
FortiGate unit.
Type Subnet/IP Range.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 111
http://docs.fortinet.com/