fortigate-ipsec-40-mr3

IPsec VPN concepts VPN gateways
Figure 2: VPN tunnel between two private networks
Site A network
10.10.1.0/24
Site A A VPN V gateway
(FortiGate FortiGate unit)
IP a.1.2.3 IP b.4.5.6 4.5.6
VPN tunnel
Site B VPN gateway tew
(FortiGate Gate unit unit)
Site B network
192.168.10.0/24
Although the IPsec traffic may actually pass through many Internet routers, you can
visualize the VPN tunnel as a simple secure connection between the two FortiGate units.
Users on the two private networks do not need to be aware of the VPN tunnel. The
applications on their computers generate packets with the appropriate source and
destination addresses, as they normally do. The FortiGate units manage all the details of
encrypting, encapsulating and sending the packets to the remote VPN gateway.
The data is encapsulated in IPsec packets only in the VPN tunnel between the two VPN
gateways. Between the user’s computer and the gateway, the data is on the secure
private network and it is in regular IP packets.
For example User1 on the Site A network, at IP address 10.10.1.7, sends packets with
destination IP address 192.168.10.8, the address of User2 on the Site B network. The
Site A FortiGate unit is configured to send packets with destinations on the 192.168.10.0
network through the VPN, encrypted and encapsulated. Similarly, the Site B FortiGate
unit is configured to send packets with destinations on the 10.10.1.0 network through the
VPN tunnel to the Site A VPN gateway.
In the site-to-site, or gateway-to-gateway VPN shown in Figure 2, the FortiGate units
have static (fixed) IP addresses and either unit can initiate communication.
You can also create a VPN tunnel between an individual PC running FortiClient and a
FortiGate unit, as shown below. This is commonly referred to as Client-to-Gateway IPsec
VPN.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 15
http://docs.fortinet.com/