fortigate-ipsec-40-mr3

GRE over IPsec (Cisco VPN) configurations Configuring the FortiGate unit
To configure security policies - web-based manager
1 Define an ACCEPT security policy to permit communications between the protected
network and the GRE tunnel:
Source Interface/Zone
Select the interface that connects to the private network
behind this FortiGate unit.
Source Address Name All
Destination
Interface/Zone
Select the GRE tunnel virtual interface you configured.
Destination Address
Name
All
Action ACCEPT
NAT Disable
2 To permit the remote client to initiate communication, you need to define a security
policy for communication in that direction:
Source Interface/Zone Select the GRE tunnel virtual interface you configured.
Source Address Name All
Destination
Select the interface that connects to the private network
Interface/Zone
behind this FortiGate unit.
Destination Address
Name
All
Action ACCEPT.
NAT Disable
3 Define a pair of ACCEPT security policies to permit traffic to flow between the GRE
virtual interface and the IPsec virtual interface:
Source Interface/Zone
Select the GRE virtual interface. See “Configuring the
GRE tunnel” on page 214.
Source Address Name All
Destination
Interface/Zone
Destination Address
Name
Select the virtual IPsec interface you created. See
“Configuring the IPsec VPN” on page 212.
All
Action ACCEPT.
NAT Disable
Source Interface/Zone
Select the virtual IPsec interface you created. See
“Configuring the IPsec VPN” on page 212.
Source Address Name All
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 215
http://docs.fortinet.com/