fortigate-ipsec-40-mr3

FortiGate dialup-client configurations Configure the FortiGate dialup client
Enable IPsec
Interface
Mode
2 Define the phase 2 parameters needed to create a VPN tunnel with the dialup server.
See “Phase 2 parameters” on page 57. Enter these settings in particular:
3 Define names for the addresses or address ranges of the private networks that the
VPN links. See “Defining policy addresses” on page 63. Enter these settings in
particular:
Define an address name for the server, host, or network behind the FortiGate dialup
server.
Define an address name for the private network behind the FortiGate dialup client.
4 Define security policies to permit communication between the private networks
through the VPN tunnel. Route-based and policy-based VPNs require different
security policies. For detailed information about creating security policies, see
“Defining VPN security policies” on page 64.
Route-based VPN security policy
Define an ACCEPT security policy to permit communications between hosts on the
private network behind this FortiGate dialup client and the private network behind the
FortiGate dialup server. Because communication cannot be initiated in the opposite
direction, there is only one policy. Enter these settings in particular:
Policy-based VPN security policy
If IPsec Interface Mode is enabled, the FortiGate unit creates a virtual
IPsec interface for a route-based VPN. Disable this option if you want
to create a policy-based VPN.
After you select OK to create the phase 1 configuration, you cannot
change this setting.
Name Enter a name to identify this phase 2 configuration.
Phase 1 Select the set of phase 1 parameters that you defined in step 1.
Source Interface/Zone
Select the interface that connects to the private
network behind this FortiGate unit.
Source Address Name Select All.
Select the VPN tunnel (IPsec interface) created in
Destination Interface/Zone
Step 1.
Destination Address Name Select All.
Action Select ACCEPT.
NAT Disable
Define an IPsec security policy to permit communications between the source and
destination addresses. Enter these settings in particular:
Source Interface/Zone
Source Address Name
Destination
Interface/Zone
Select the interface that connects to the private network
behind this FortiGate unit.
Select the address name that you defined in Step 3 for
the private network behind this FortiGate unit.
Select the FortiGate unit’s public interface.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 139
http://docs.fortinet.com/