fortigate-ipsec-40-mr3

Site-to-site IPv4 over IPv6 VPN example IPv6 IPsec VPNs
set action accept
set service ANY
set schedule always
end
Configure FortiGate A routing
Configure FortiGate B
This simple example requires just two static routes. Traffic to the protected network
behind FortiGate B is routed via the virtual IPsec interface toB using an IPv4 static route.
A default route sends all IPv6 traffic, including the IPv6 IPsec packets, out on port2.
config router static6
edit 1
set device port2
set dst 0::/0
next
edit 2
set device toB
set dst 192.168.3.0/24
end
The configuration of FortiGate B is very similar to that of FortiGate A. A virtual IPsec
interface toA is configured on port2 and its remote gateway is the public IP address of
FortiGate A. The IPsec phase 2 configuration has IPv4 selectors.
IPv4 security policies enable traffic to pass between the private network and the IPsec
interface. An IPv4 static route ensures traffic for the private network behind FortiGate A
goes through the VPN and an IPv6 static route ensures that all IPv6 packets are routed to
the public network.
config system interface
edit port2
config ipv6
set ip6-address fec0::0003:fe83:25c7/64
end
next
edit port3
set 192.168.3.1/24
end
config vpn ipsec phase1-interface
edit toA
set ip-version 6
set interface port2
set remote-gw6 fec0:0000:0000:0001:209:0fff:fe83:25f2
set dpd enable
set psksecret maryhadalittlelamb
set proposal 3des-md5 3des-sha1
end
config vpn ipsec phase2-interface
edit toA2
set phase1name toA
set proposal 3des-md5 3des-sha1
set pfs enable
set replay enable
end
IPsec VPNs for FortiOS 4.0 MR3
194 01-434-112804-20120111
http://docs.fortinet.com/