fortigate-ipsec-40-mr3

Clients, servers, and peers IPsec VPN concepts
Clients, servers, and peers
Figure 3: VPN tunnel between a FortiClient PC and a FortiGate unit
Office network
10.10.1.0/24
Office fice FortiGa FortiGate unit
a.1.2.3 b.4.5.6
VPN tunnel
On the PC, the FortiClient application acts as the local VPN gateway. Packets destined
for the office network are encrypted, encapsulated into IPsec packets, and sent through
the VPN tunnel to the FortiGate unit. Packets for other destinations are routed to the
Internet as usual. IPsec packets arriving through the tunnel are decrypted to recover the
original IP packets.
A FortiGate unit in a VPN can have one of the following roles:
server — responds to a request to establish a VPN tunnel.
client — contacts a remote VPN gateway and requests a VPN tunnel.
FortiClient PC
peer — brings up a VPN tunnel or responds to a request to do so.
The site-to-site VPN shown in Figure 2 is a peer-to-peer relationship. Either FortiGate unit
VPN gateway can establish the tunnel and initiate communications. The
FortiClient-to-FortiGate VPN shown in Figure 3 is a client-server relationship. The
FortiGate unit establishes a tunnel when the FortiClient PC requests one.
A FortiGate unit cannot be a VPN server if it has a dynamically-assigned IP address. VPN
clients need to be configured with a static IP address for the server.
A FortiGate unit acts as a server only when the remote VPN gateway has a dynamic IP
address or is a client-only device or application, such as FortiClient.
As a VPN server, a FortiGate unit can also offer automatic configuration for FortiClient
PCs. The user needs to know only the IP address of the FortiGate VPN server and a valid
user name/password. FortiClient downloads the VPN configuration settings from the
FortiGate VPN server. For information about configuring a FortiGate unit as a VPN server,
see the FortiClient Administration Guide.
IPsec VPNs for FortiOS 4.0 MR3
16 01-434-112804-20120111
http://docs.fortinet.com/