fortigate-ipsec-40-mr3

Hardware offloading and acceleration IPsec offloading configuration examples
IPsec offloading configuration examples
The following examples configure two FortiASIC NP2 accelerated VPNs, one
route-based, the other policy based. In both cases, the network topology is as shown in
Figure 36.
Figure 36: Hardware accelerated IPsec VPN topology
Protected network
ASM-FB4 4
Port 1
1.1.1.0/2444
ASM-FB4
Port 2 (IPsec)
3.3.3.1/24
FortiGate_1
Fo Fo Fo Fo Fo Fo Fo Fort rt rt rt rt rtiiiG tiG
iGaa 1111
ASM-FB4
Port 2 (IPsec)
3.3.3.2/24
FortiGate_2
Fo Fooort rt rt rtt rtiG iG iG iG iG iG tee_22222
AASM-FB4
Port 1
22 2.2.2.0/24
Protected network
Accelerated route-based VPN configuration
This example uses the accelerated ports on FortiGate-ASM-FB4 modules in each
FortiGate unit. These accelerated ports on the modules are paired interfaces that have
their own network processor (NPU) to offload work from the FortiGate unit CPU. Beyond
this fact, the example is normal VPN example.
Configuring the FortiGate units require the same basic steps:
Configure VPN Phase 1
Configure VPN Phase 2
Create security policies to allow traffic to flow
Create a static route to allow traffic to flow
When both FortiGates are have the VPN tunnel configured, test to ensure it is working
properly.
To configure FortiGate_1
1 Go to VPN > IPsec > Auto Key (IKE) and select Create Phase 1.
2 Configure Phase 1 settings (name FGT_1_IPsec), plus
Select Advanced.
Select Enable IPsec Interface Mode.
In Local Gateway IP, select Specify and enter the VPN IP address 3.3.3.1, which is
the IP address of FortiGate_1’s FortiGate-ASM-FB4 module on port 2.
3 Select OK.
4 Select Create Phase 2 and configure Phase 2 settings, including
Select Enable replay detection.
set enc-offload-antireplay to enable using the config system npu CLI
command.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 231
http://docs.fortinet.com/