fortigate-ipsec-40-mr3

FortiClient-to-FortiGate VPN configuration steps FortiClient dialup-client configurations
If the FortiGate interface to the private network is not the default gateway, the private
network behind the FortiGate unit must be configured to route IP traffic destined for
dialup clients back (through an appropriate gateway) to the FortiGate interface to the
private network. As an alternative, you can configure the IPsec security policy on the
FortiGate unit to perform inbound NAT on IP packets. Inbound NAT translates the
source addresses of inbound decrypted packets into the IP address of the FortiGate
interface to the local private network.
FortiClient-to-FortiGate VPN configuration steps
Configuring dialup client capability for FortiClient dialup clients involves the following
general configuration steps:
1 If you will be using VIP addresses to identify dialup clients, determine which VIP
addresses to use. As a precaution, consider using VIP addresses that are not
commonly used.
2 Configure the FortiGate unit to act as a dialup server. See “Configure the FortiGate
unit” on page 120.
3 If the dialup clients will be configured to obtain VIP addresses through DHCP over
IPsec, configure the FortiGate unit to act as a DHCP server or to relay DHCP requests
to an external DHCP server.
4 Configure the dialup clients. See “Configure the FortiClient Endpoint Security
application” on page 125.
When a FortiGate unit has been configured to accept connections from FortiClient dialupclients,
you can optionally arrange to have an IPsec VPN configuration downloaded to
FortiClient dialup clients automatically. For more information, see “Configuring the
FortiGate unit as a VPN policy server” on page 123.
Configure the FortiGate unit
Configuring the FortiGate unit to establish VPN connections with FortiClient Endpoint
Security users involves the following steps:
1 configure the VPN settings
2 if the dialup clients use automatic configuration, configure the FortiGate unit as a VPN
policy server
3 if the dialup clients obtain VIP addresses by DHCP over IPsec, configure an IPsec
DHCP server or relay
The procedures in this section cover basic setup of policy-based and route-based VPNs
compatible with FortiClient Endpoint Security. A route-based VPN is simpler to configure.
Configuring FortiGate unit VPN settings
To configure FortiGate unit VPN settings to support FortiClient users, you need to:
configure the FortiGate Phase 1 VPN settings
configure the FortiGate Phase 2 VPN settings
add the security policy
1 At the local FortiGate unit, define the phase 1 configuration needed to establish a
secure connection with the FortiClient peer. See “Auto Key phase 1 parameters” on
page 39. Enter these settings in particular:
IPsec VPNs for FortiOS 4.0 MR3
120 01-434-112804-20120111
http://docs.fortinet.com/