fortigate-ipsec-40-mr3

Internet-browsing configuration Routing all remote traffic through the VPN tunnel
To create an Internet browsing policy - route-based VPN
1 Go to Policy > Policy > Policy.
2 Select Create New, enter the following information and then select OK:
Source Interface The IPsec VPN interface.
Source Address Name All
Destination Interface
The interface that connects to the Internet. The virtual
IPsec interface is configured on this physical
interface.
Destination Address Name All
Schedule As required.
Service As required.
Action ACCEPT
NAT Enable
UTM
Select the UTM features that you want to apply to
Internet access.
The VPN clients must be configured to route all Internet traffic through the VPN tunnel.
Routing all remote traffic through the VPN tunnel
To make use of the Internet browsing configuration on the VPN server, the VPN peer or
client must route all traffic through the VPN tunnel. Usually, only the traffic destined for
the private network behind the FortiGate VPN server is sent through the tunnel.
The remote end of the VPN can be a FortiGate unit that acts as a peer in a gateway-togateway
configuration or a FortiClient Endpoint Security application that protects an
individual client such as a notebook PC.
To configure a remote peer FortiGate unit for Internet browsing via VPN, see
“Configuring a FortiGate remote peer to support Internet browsing”.
To configure a FortiClient Endpoint Security application for Internet browsing via VPN,
see “Configuring a FortiClient application to support Internet browsing” on page 150.
These procedures assume that your VPN connection to the protected private network is
working and that you have configured the FortiGate VPN server for Internet browsing as
described in “Creating an Internet browsing security policy” on page 148.
Configuring a FortiGate remote peer to support Internet browsing
The configuration changes to send all traffic through the VPN differ for policy-based and
route-based VPNs.
To route all traffic through a policy-based VPN
1 At the FortiGate dialup client, go to Policy > Policy > Policy.
2 Select the IPsec security policy and then select Edit.
3 From the Destination Address list, select all.
4 Select OK.
All packets are routed through the VPN tunnel, not just packets destined for the
protected private network.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 149
http://docs.fortinet.com/