fortigate-ipsec-40-mr3

Site-to-site IPv6 over IPv4 VPN example IPv6 IPsec VPNs
config system interface
edit port2
set 10.0.0.1/24
next
edit port3
config ipv6
set ip6-address fec0::0001:209:0fff:fe83:25f3/64
end
Configure FortiGate A IPsec settings
The phase 1 configuration uses IPv4 addressing.
config vpn ipsec phase1-interface
edit toB
set interface port2
set remote-gw 10.0.1.1
set dpd enable
set psksecret maryhadalittlelamb
set proposal 3des-md5 3des-sha1
end
The phase 2 configuration uses IPv6 selectors. By default, phase 2 selectors are set to
accept all subnet addresses for source and destination. The default setting for
src-addr-type and dst-addr-type is subnet. The IPv6 equivalent is subnet6. The
default subnet addresses are 0.0.0.0/0 for IPv4, ::/0 for IPv6.
config vpn ipsec phase2-interface
edit toB2
set phase1name toB
set proposal 3des-md5 3des-sha1
set pfs enable
set replay enable
set src-addr-type subnet6
set dst-addr-type subnet6
end
Configure FortiGate A security policies
IPv6 security policies are required to allow traffic between port3 and the IPsec interface
toB in each direction. The address all6 must be defined using the
firewall address6 command as ::/0.
config firewall policy6
edit 1
set srcintf port3
set dstintf toB
set srcaddr all6
set dstaddr all6
set action accept
set service ANY
set schedule always
next
edit 2
set srcintf toB
set dstintf port3
set srcaddr all6
set dstaddr all6
IPsec VPNs for FortiOS 4.0 MR3
196 01-434-112804-20120111
http://docs.fortinet.com/