fortigate-ipsec-40-mr3

Configuring the FortiGate unit GRE over IPsec (Cisco VPN) configurations
Destination
Interface/Zone
Destination Address
Name
Select the GRE virtual interface. See “Configuring the
GRE tunnel” on page 214.
All
Action Select ACCEPT.
NAT Disable.
To configure security policies - CLI
config firewall policy
edit 1 // LAN to GRE tunnel
set srcintf port2
set dstintf gre1
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 2 // GRE tunnel to LAN
set srcintf gre1
set dstintf port2
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 3 // GRE tunnel to IPsec interface
set srcintf "gre1"
set dstintf "tocisco"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
next
edit 4 // IPsec interface to GRE tunnel
set srcintf "tocisco"
set dstintf "gre1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
end
IPsec VPNs for FortiOS 4.0 MR3
216 01-434-112804-20120111
http://docs.fortinet.com/