fortigate-ipsec-40-mr3

General preparation steps IPsec VPN Overview
General preparation steps
These sections contain high-level configuration guidelines with cross-references to
detailed configuration procedures. If you need more detail to complete a step, select the
cross-reference in the step to drill-down to more detail. Return to the original procedure
to complete the procedure. For a general overview of how to configure a VPN, see
“General preparation steps” below.
A VPN configuration defines relationships between the VPN devices and the private
hosts, servers, or networks making up the VPN. Configuring a VPN involves gathering
and recording the following information. You will need this information to configure the
VPN.
The private IP addresses of participating hosts, servers, and/or networks. These
IP addresses represent the source addresses of traffic that is permitted to pass
through the VPN. A IP source address can be an individual IP address, an address
range, or a subnet address.
The public IP addresses of the VPN end-point interfaces. The VPN devices
establish tunnels with each other through these interfaces.
The private IP addresses associated with the VPN-device interfaces to the
private networks. Computers on the private networks behind the VPN gateways will
connect to their VPN gateways through these interfaces.
How to use this guide to configure an IPsec VPN
This guide uses a task-based approach to provide all of the procedures needed to create
different types of VPN configurations. Follow the step-by-step configuration procedures
in this guide to set up the VPN.
The following configuration procedures are common to all IPsec VPNs:
1 Define the phase 1 parameters that the FortiGate unit needs to authenticate remote
peers or clients and establish a secure a connection. See “Auto Key phase 1
parameters” on page 39.
2 Define the phase 2 parameters that the FortiGate unit needs to create a VPN tunnel
with a remote peer or dialup client. See “Phase 2 parameters” on page 57.
3 Specify the source and destination addresses of IP packets that are to be transported
through the VPN tunnel. See “Defining policy addresses” on page 63.
4 Create an IPsec security policy to define the scope of permitted services between the
IP source and destination addresses. See “Defining VPN security policies” on
page 64.
These steps assume you configure the FortiGate unit to generate unique IPsec encryption
and authentication keys automatically. In situations where a remote VPN peer or client
requires a specific IPsec encryption and authentication key, you must configure the
FortiGate unit to use manual keys instead of performing Steps 1 and 2. For more
information, see “Manual-key configurations” on page 183.
IPsec VPNs for FortiOS 4.0 MR3
24 01-434-112804-20120111
http://docs.fortinet.com/