fortigate-ipsec-40-mr3

IPsec VPN concepts
VPN tunnels
FortiOS Handbook
Virtual Private Network (VPN) technology enables remote users to connect to private
computer networks to gain access to their resources in a secure way. For example, an
employee traveling or working from home can use a VPN to securely access the office
network through the Internet.
Instead of remotely logging on to a private network using an unencrypted and unsecure
Internet connection, the use of a VPN ensures that unauthorized parties cannot access
the office network and cannot intercept any of the information that is exchanged between
the employee and the office. It is also common to use a VPN to connect the private
networks of two or more offices.
Fortinet offers VPN capabilities in the FortiGate Unified Threat Management (UTM)
appliance and in the FortiClient Endpoint Security suite of applications. A FortiGate unit
can be installed on a private network, and FortiClient software can be installed on the
user’s computer. It is also possible to use a FortiGate unit to connect to the private
network instead of using FortiClient software.
This chapter discusses VPN terms and concepts including:
VPN tunnels
VPN gateways
Clients, servers, and peers
Encryption
Authentication
Phase 1 and Phase 2 settings
Security Association
The data path between a user’s computer and a private network through a VPN is
referred to as a tunnel. Like a physical tunnel, the data path is accessible only at both
ends. In the telecommuting scenario, the tunnel runs between the FortiClient application
on the user’s PC, or a FortiGate unit or other network device and the FortiGate unit on the
office private network.
Encapsulation makes this possible. IPsec packets pass from one end of the tunnel to the
other and contain data packets that are exchanged between the local user and the
remote private network. Encryption of the data packets ensures that any third-party who
intercepts the IPsec packets can not access the data.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 13
http://docs.fortinet.com/