fortigate-ipsec-40-mr3

Configuring the FortiGate unit GRE over IPsec (Cisco VPN) configurations
Configuring the FortiGate unit
There are several steps to the GRE-over-IPsec configuration:
Enable overlapping subnets. This is needed because the IPsec and GRE tunnels will
use the same addresses.
Configure a route-based IPsec VPN on the external interface.
Configure a GRE tunnel on the virtual IPsec interface. Set its local gateway and
remote gateway addresses to match the local and remote gateways of the IPsec
tunnel.
Configure security policies to allow traffic to pass in both directions between the GRE
virtual interface and the IPsec virtual interface.
Configure security policies to allow traffic to pass in both directions between the
protected network interface and the GRE virtual interface.
Configure a static route to direct traffic destined for the network behind the Cisco
router into the GRE-over-IPsec tunnel.
Enabling overlapping subnets
By default, each FortiGate unit network interface must be on a separate network. The
configuration described in this chapter assigns an IPsec tunnel end point and the
external interface to the same network. Enable subnet overlap as follows:
config system settings
set allow-subnet-overlap enable
end
Configuring the IPsec VPN
A route-based VPN is required. It must use encryption and authentication algorithms
compatible with the Cisco equipment to which it connects. In this chapter, preshared key
authentication is shown.
To configure the IPsec VPN - web-based manager
1 Define the phase 1 configuration needed to establish a secure connection with the
remote Cisco device. Enter these settings in particular:
Enter a name to identify the VPN tunnel, tocisco for
example. This is the name of the virtual IPsec interface. It
Name
appears in phase 2 configurations, security policies and
the VPN monitor.
Remote Gateway Select Static IP Address.
IP Address
Enter the IP address of the Cisco device public interface.
For example, 192.168.5.113
Local Interface
Select the FortiGate unit’s public interface. For example,
172.20.120.141
Mode Select Main (ID Protection).
Authentication Method Preshared Key
Pre-shared Key
Enter the preshared key. It must match the preshared key
on the Cisco device.
Advanced Select the Advanced button to see the following settings.
IPsec VPNs for FortiOS 4.0 MR3
212 01-434-112804-20120111
http://docs.fortinet.com/