fortigate-ipsec-40-mr3

More documents

Recommendations

Info

Planning your VPN IPsec VPN Overview Policy-based VPNs For a policy-based VPN, one security policy enables communication in both directions. You must select IPSEC as the Action and then select the VPN tunnel you defined in the phase 1 settings. You can then enable inbound and outbound traffic as needed within that policy, or create multiple policies of this type to handle different types of traffic differently. For example HTTPS traffic may not require the same level of scanning as FTP traffic. Comparing policy-based or route-based VPNs Planning your VPN For both VPN types you create phase 1 and phase 2 configurations. Both types are handled in the stateful inspection security layer, assuming there is no IPS or AV. For more information on the three security layers, see the FortiOS Troubleshooting guide. The main difference is in the security policy. You create a policy-based VPN by defining an IPSEC security policy between two network interfaces and associating it with the VPN tunnel (phase 1) configuration. You create a route-based VPN by enabling IPsec interface mode in the VPN phase 1 configuration. This creates a virtual IPsec interface. You then define a regular ACCEPT security policy to permit traffic to flow between the virtual IPsec interface and another network interface. And lastly, configure a static route to allow traffic over the VPN. Where possible, you should create route-based VPNs. Generally, route-based VPNs are more flexible and easier to configure than policy-based VPNs — by default they are treated as interfaces. However, these two VPN types have different requirements that limit where they can be used. Table 1: Comparison of policy-based and route-based VPNs Features Policy-based Route-based Both NAT and transparent modes available Yes NAT mode only L2TP-over-IPsec supported GRE-over-IPsec supported security policy requirements Number of policies per VPN Yes No No Yes Requires a security policy with IPSEC action that specifies the VPN tunnel One policy controls connections in both directions Requires only a simple security policy with ACCEPT action A separate policy is required for connections in each direction It is a good idea to plan the VPN configuration ahead of time. This will save time later and be help you configure your VPN correctly. All VPN configurations comprise a number of required and optional parameters. Before you begin, you need to determine: where does the IP traffic originate and where does it need to be delivered which hosts, servers, or networks to include in the VPN IPsec VPNs for FortiOS 4.0 MR3 22 01-434-112804-20120111 http://docs.fortinet.com/
IPsec VPN Overview Planning your VPN Network topologies which VPN devices to include in the configuration through which interfaces the VPN devices communicate through which interfaces do private networks access the VPN gateways Once you have this information, you can select a VPN topology that meets the requirements of your situation. The topology of your network will determine how remote peers and clients connect to the VPN and how VPN traffic is routed. You can read about various network topologies and find the high-level procedures needed to configure IPsec VPNs in one of these sections. Table 2: VPN network topologies and brief descriptions Topology Description Gateway-togateway configurations Hub-and-spoke configurations Dynamic DNS configuration FortiClient dialupclient configurations FortiGate dialupclient configurations Internet-browsing configuration Redundant VPN configurations Transparent mode VPNs Manual-key configurations L2TP and IPsec (Microsoft VPN) Standard one-to-one VPN between two FortiGate units. See “Gateway-to-gateway configurations” on page 69. One central FortiGate unit has multiple VPNs to other remote FortiGate units. See “Hub-and-spoke configurations” on page 85. One end of the VPN tunnel has a changing IP address and the other end must go to a dynamic DNS server for the current IP address before establishing a tunnel. See “Dynamic DNS configuration” on page 101. Typically remote FortiClient dialup-clients use dynamic IP addresses through NAT devices. The FortiGate unit acts as a dialup server allowing dialup VPN connections from multiple sources. See “FortiClient dialup-client configurations” on page 115. Similar to FortiClient dialup-client configurations but with more gateway-to-gateway settings such as unique user authentication for multiple users on a single VPN tunnel. See “FortiGate dialupclient configurations” on page 133. Secure web browsing performed by dialup VPN clients, and/or hosts behind a remote VPN peer. See “Internet-browsing configuration” on page 147. Options for supporting redundant and partially redundant IPsec VPNs, using route-based approaches. See “Redundant VPN configurations” on page 151. In transparent mode, the FortiGate acts as a bridge with all incoming traffic being broadcast back out on all other interfaces. Routing and NAT must be performed on external routers. See “Transparent mode VPNs” on page 175. Manually define cryptographic keys to establish an IPsec VPN, either policy-based or route-based. See “Manual-key configurations” on page 183. Configure VPN for Microsoft Windows dialup clients using the built in L2TP software. Users do not have to install any See “L2TP and IPsec (Microsoft VPN)” on page 199. FortiOS Handbook v3: IPsec VPNs 01-434-112804-20120111 23 http://docs.fortinet.com/
Page 1 and 2: IPsec VPNs FortiOS Handbook v3 for
Page 3 and 4: Contents FortiOS Handbook Introduct
Page 5 and 6: Contents Outbound and inbound NAT.
Page 7 and 8: Contents Configure the FortiGate un
Page 9 and 10: Contents Site-to-site IPv6 over IPv
Page 11 and 12: Introduction How this guide is orga
Page 13 and 14: IPsec VPN concepts VPN tunnels Fort
Page 15 and 16: IPsec VPN concepts VPN gateways Fig
Page 17 and 18: IPsec VPN concepts Encryption Encry
Page 19 and 20: IPsec VPN concepts Security Associa
Page 21: IPsec VPN Overview Types of VPNs Ro
Page 25 and 26: FortiOS Handbook IPsec VPN in the w
Page 27 and 28: IPsec VPN in the web-based manager
Page 39 and 40: FortiOS Handbook Auto Key phase 1 p
Page 41 and 42: Auto Key phase 1 parameters Choosin
Page 43 and 44: Auto Key phase 1 parameters Authent
Page 49 and 50: Auto Key phase 1 parameters Definin
Page 55 and 56: Auto Key phase 1 parameters Using X
Page 57 and 58: Phase 2 parameters Basic phase 2 se
Page 59 and 60: Phase 2 parameters Advanced phase 2
Page 61 and 62: Phase 2 parameters Configure the ph
Page 63 and 64: FortiOS Handbook Defining VPN secur
Page 65 and 66: Defining VPN security policies Defi
Page 67 and 68: Defining VPN security policies Defi
Page 69 and 70: FortiOS Handbook Gateway-to-gateway
Page 71 and 72: Gateway-to-gateway configurations G
Page 73 and 74:
Gateway-to-gateway configurations C
Page 75 and 76:
Gateway-to-gateway configurations C
Page 77 and 78:
Gateway-to-gateway configurations H
Page 79 and 80:
Gateway-to-gateway configurations H
Page 81 and 82:
Gateway-to-gateway configurations T
Page 83 and 84:
Gateway-to-gateway configurations T
Page 85 and 86:
FortiOS Handbook Hub-and-spoke conf
Page 87 and 88:
Hub-and-spoke configurations Config
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Hub-and-spoke configurations Dynami
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
FortiOS Handbook Dynamic DNS config
Page 103 and 104:
Dynamic DNS configuration Dynamic D
Page 105 and 106:
Dynamic DNS configuration Configure
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
FortiOS Handbook FortiClient dialup
Page 117 and 118:
FortiClient dialup-client configura
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
FortiGate dialup-client configurati
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
FortiOS Handbook Supporting IKE Mod
Page 143 and 144:
Supporting IKE Mode config clients
Page 145 and 146:
Supporting IKE Mode config clients
Page 147 and 148:
FortiOS Handbook Internet-browsing
Page 149 and 150:
Internet-browsing configuration Rou
Page 151 and 152:
FortiOS Handbook Redundant VPN conf
Page 153 and 154:
Redundant VPN configurations Config
Page 155 and 156:
Redundant VPN configurations Redund
Page 157 and 158:
Page 159 and 160:
Page 161 and 162:
Page 163 and 164:
Page 165 and 166:
Page 167 and 168:
Redundant VPN configurations Partia
Page 169 and 170:
Page 171 and 172:
Page 173 and 174:
Redundant VPN configurations Creati
Page 175 and 176:
FortiOS Handbook Transparent mode V
Page 177 and 178:
Transparent mode VPNs Configuration
Page 179 and 180:
Transparent mode VPNs Configure the
Page 181 and 182:
Transparent mode VPNs Configure the
Page 183 and 184:
FortiOS Handbook Manual-key configu
Page 185 and 186:
Manual-key configurations Specify t
Page 187 and 188:
IPv6 IPsec VPNs FortiOS Handbook Th
Page 189 and 190:
IPv6 IPsec VPNs Site-to-site IPv6 o
Page 191 and 192:
Page 193 and 194:
Page 195 and 196:
Page 197 and 198:
Page 199 and 200:
FortiOS Handbook L2TP and IPsec (Mi
Page 201 and 202:
L2TP and IPsec (Microsoft VPN) Conf
Page 203 and 204:
Page 205 and 206:
Page 207 and 208:
L2TP and IPsec (Microsoft VPN) Trou
Page 209 and 210:
L2TP and IPsec (Microsoft VPN) Trou
Page 211 and 212:
FortiOS Handbook GRE over IPsec (Ci
Page 213 and 214:
GRE over IPsec (Cisco VPN) configur
Page 215 and 216:
Page 217 and 218:
Page 219 and 220:
Page 221 and 222:
FortiOS Handbook Protecting OSPF wi
Page 223 and 224:
Protecting OSPF with IPsec OSPF ove
Page 225 and 226:
Protecting OSPF with IPsec OSPF ove
Page 227 and 228:
Protecting OSPF with IPsec Creating
Page 229 and 230:
FortiOS Handbook Hardware offloadin
Page 231 and 232:
Hardware offloading and acceleratio
Page 233 and 234:
Hardware offloading and acceleratio
Page 235 and 236:
FortiOS Handbook Monitoring and tro
Page 237 and 238:
Monitoring and troubleshooting Test
Page 239 and 240:
Monitoring and troubleshooting Logg
Page 241 and 242:
Monitoring and troubleshooting VPN
Page 243 and 244:
Index Numerics 3DES-Triple-DES, 51
Page 245 and 246:
IPcomp, 237 IPsec, 230 tunnel, 229
Page 247 and 248:
security association (SA), 230 secu
show all

fortigate-ipsec-40-mr3

Create successful ePaper yourself

Delete template?

Save as template?