fortigate-ipsec-40-mr3

IPsec VPN concepts Security Association
Security Association
To configure default Phase 2 settings on a FortiGate unit, you need only select the name
of the corresponding Phase 1 configuration. In FortiClient, no action is required to enable
default Phase 2 settings.
For more detailed information about Phase 2 settings, see “Phase 2 parameters” on
page 57.
The establishment of a Security Association (SA) is the successful outcome of Phase 1
negotiations. Each peer maintains a database of information about VPN connections. The
information in each SA can include cryptographic algorithms and keys, keylife, and the
current packet sequence number. This information is kept synchronized as the VPN
operates. Each SA has a Security Parameter Index (SPI) that is provided to the remote
peer at the time the SA is established. Subsequent IPsec packets from the peer always
reference the relevant SPI. It is possible for peers to have multiple VPNs active
simultaneously, and correspondingly multiple SPIs.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 19
http://docs.fortinet.com/