fortigate-ipsec-40-mr3

FortiClient dialup-client configurations Configuration overview
One button FortiGate - to - FortiClient Phase1 VPN
On the FortiOS VPN IKE page there is a button to create a Phase1 portion of a VPN
tunnel between the FortiGate and FortiClient. Very little information is required for this
configuration. No encryption or authentication method is required. This feature is ideal for
setting up quick VPN connections with basic settings.
This one button is only compatible with FortiClient 4.3 and higher. Earlier versions of
FortiClient need to create IKE Phase-1 object separately, similar to earlier versions of
FortiOS.
On the Phase 1 screen (VPN > IPsec > Phase 1) is a button called Create a FortiClient
VPN. This button asks a few basic VPN configuration related questions. Once all the
information is added, click Create Now. This will create a new dial-up IPsec-interface
mode tunnel. Phase 1 and Phase 2 will be added using the default ike settings.
The following Settings will be used when creating a one-button FortiClient VPN Phase1
object:
Remote Gateway: Dialup User
Mode: Aggressive
Enable IPSec Interface Mode
Default setting for P1 and P2 Proposal
XAUTH Enable as Server (Auto)
IKE mode-config will be enabled
Peer Option set to "Accept any peer ID"
Rest of the setting use the current defaults (Default value needs to be the same on
FCT side)
Once the one button Phase1 is complete, you must create a default Phase2
configuration. This only requires a name for the Phase2 object, and select the one-button
Phase1 name.
How the FortiGate unit determines which settings to apply
The FortiGate unit follows these steps to determine the configuration information to send
to the FortiClient application:
1 Check the virtual domain associated with the connection to determine which VPN
policies might apply.
2 Select the VPN policy that matches the dialup client’s user group and determine
which tunnel (phase 1 configuration) is involved.
3 Check all IPsec security policies that use the specified tunnel to determine which
private networks the dialup clients may access.
4 Retrieve the rest of the VPN policy information from the existing IPsec phase 1 and
phase 2 parameters in the dialup-client configuration.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 117
http://docs.fortinet.com/