fortigate-ipsec-40-mr3

More documents

Recommendations

Info

VPN troubleshooting tips Monitoring and troubleshooting The mode setting for ID protection (main or aggressive) on both VPN peers must be identical. The authentication method (preshared keys or certificates) used by the client must be supported on the FortiGate unit and configured properly. If preshared keys are being used for authentication purposes, both VPN peers must have identical preshared keys. The remote client must have at least one set of phase 1 encryption, authentication, and Diffie-Hellman settings that match corresponding settings on the FortiGate unit. Both VPN peers must have the same NAT traversal setting (enabled or disabled). The remote client must have at least one set of phase 2 encryption and authentication algorithm settings that match the corresponding settings on the FortiGate unit. If you are using manual keys to establish a tunnel, the Remote SPI setting on the FortiGate unit must be identical to the Local SPI setting on the remote peer, and vise versa. 5 To correct the problem, see the following table. Table 8: VPN trouble-shooting tips Configuration problem Correction Mode settings do not match. Peer ID or certificate name of the remote peer or dialup client is not recognized by FortiGate VPN server. Preshared keys do not match. Phase 1 or phase 2 key exchange proposals are mismatched. NAT traversal settings are mismatched. SPI settings for manual key tunnels are mismatched. A word about NAT devices Select complementary mode settings. See “Choosing main mode or aggressive mode” on page <strong>40</strong>. Check Phase 1 configuration. Depending on the Remote Gateway and Authentication Method settings, you have a choice of options to authenticate FortiGate dialup clients or VPN peers by ID or certificate name (see “Authenticating remote peers and clients” on page 44). If you are configuring authentication parameters for FortiClient dialup clients, refer to the Authenticating FortiClient Dialup Clients Technical Note. Reenter the preshared key. See “Authenticating remote peers and clients” on page 44. Make sure that both VPN peers have at least one set of proposals in common for each phase. See “Defining IKE negotiation parameters” on page 49 and “Configure the phase 2 parameters” on page 60. Select or clear both options as required. See “NAT traversal” on page 52 and “NAT keepalive frequency” on page 53. Enter complementary SPI settings. See “Manual-key configurations” on page 183. When a device with NAT capabilities is located between two VPN peers or a VPN peer and a dialup client, that device must be NAT traversal (NAT-T) compatible for encrypted traffic to pass through the NAT device. For more information, see “NAT traversal” on page 52. IPsec VPNs for FortiOS 4.0 MR3 242 01-434-112804-20120111 http://docs.fortinet.com/
Index Numerics 3DES-Triple-DES, 51 A Accept peer certificate, 46 Accept this peer certificate group only, 46 adding, configuring defining IPSec VPN phase 1, 26 IPSec VPN phase 1 advanced options, 28 IPSec VPN phase 2, 31 IPSec VPN phase 2 advanced options, 31 AES128,192 ,256, 51 aggregated subnets for hub-and-spoke VPN, 86 aggressive mode, 39 Allow inbound, encryption policy, 65 Allow outbound, encryption policy, 65 ambiguous routing resolving in FortiGate dialup-client configuration, 134 VPN routing, 76 antireplay, 230 authenticating based on peer IDs, 46 FortiGate unit pre-shared key, 43 IPsec VPN peers and clients, 44 through IPsec certificate, 41 through XAuth settings, 54 authentication SHA-1, 256, 384, 512, 51 Authentication Algorithm Manual Key, 184 Authentication Key, Manual Key, 185 authentication server, XAuth, 54 Autokey IPSec VPN, 25 keep alive, 59 Keep Alive, IPsec interface mode, 61 B backup VPN, 173 C Certificate Name, Phase 1, 42 certificate, IPsec group, 45 Local ID setting, 46 using DN to establish access, 44 viewing local DN, 45 FortiOS Handbook Challenge-Handshake Authentication Protocol (CHAP), 55 Cisco VPN, 211 client IP assigning with RADIUS, 119 concentrator, 90 IPSec tunnel mode, 36 IPSec VPN, policy-based, 36 configuring dynamic DNS VPN, 104 FortiClient dialup-client VPN, 120 FortiClient in dialup-client VPN, 125 FortiGate dialup-client VPN, 136 FortiGate in dialup-client IPsec VPN, 138 gateway-to-gateway IPsec VPN, 71 hub-and-spoke IPsec VPN, 85 manual keys, 184 transparent mode IPsec VPN, 179 cryptographic load, 229 FortiOS Handbook v3: IPsec VPNs 01-434-112804-20120111 243 http://docs.fortinet.com/ D dead gateway detection, 83 Dead Peer Detection (DPD), 53, 83 Phase 1, 52, 53 designated router (DR), OSPF, 223 DH Group IPsec interface mode, 61 Phase 1, 49, 52 Phase 2, 58 DH key size, FIPS-CC, 49 DHCP relay in FortiClient dialup-client configuration, 123 in FortiGate dialup client configuration, 135 DHCP server, 59 in FortiClient dialup-client configuration, 123 DHCP-IPsec IPsec interface mode, 61 IPSec VPN, phase 2, 33 phase 2, 59 dialup-client IPsec configuration DHCP server and relay, FortiClient VIP, 123 dialup server for FortiClient dialup clients, 120 dialup server for FortiGate dialup clients, 136 FortiGate client configuration, 138 FortiGate dialup client configuration, 136 requirements for FortiClient access, 119 requirements for FortiGate client access, 135 Diffie-Hellman algorithm, 49, 58 Digital Encryption Standard, 17 DNS server, dynamic DNS configuration, 104 domain name, dynamic DNS configuration, 103, 105
Page 1 and 2:
IPsec VPNs FortiOS Handbook v3 for
Page 3 and 4:
Contents FortiOS Handbook Introduct
Page 5 and 6:
Contents Outbound and inbound NAT.
Page 7 and 8:
Contents Configure the FortiGate un
Page 9 and 10:
Contents Site-to-site IPv6 over IPv
Page 11 and 12:
Introduction How this guide is orga
Page 13 and 14:
IPsec VPN concepts VPN tunnels Fort
Page 15 and 16:
IPsec VPN concepts VPN gateways Fig
Page 17 and 18:
IPsec VPN concepts Encryption Encry
Page 19 and 20:
IPsec VPN concepts Security Associa
Page 21 and 22:
IPsec VPN Overview Types of VPNs Ro
Page 23 and 24:
IPsec VPN Overview Planning your VP
Page 25 and 26:
FortiOS Handbook IPsec VPN in the w
Page 27 and 28:
IPsec VPN in the web-based manager
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
FortiOS Handbook Auto Key phase 1 p
Page 41 and 42:
Auto Key phase 1 parameters Choosin
Page 43 and 44:
Auto Key phase 1 parameters Authent
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Auto Key phase 1 parameters Definin
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Auto Key phase 1 parameters Using X
Page 57 and 58:
Phase 2 parameters Basic phase 2 se
Page 59 and 60:
Phase 2 parameters Advanced phase 2
Page 61 and 62:
Phase 2 parameters Configure the ph
Page 63 and 64:
FortiOS Handbook Defining VPN secur
Page 65 and 66:
Defining VPN security policies Defi
Page 67 and 68:
Defining VPN security policies Defi
Page 69 and 70:
FortiOS Handbook Gateway-to-gateway
Page 71 and 72:
Gateway-to-gateway configurations G
Page 73 and 74:
Gateway-to-gateway configurations C
Page 75 and 76:
Gateway-to-gateway configurations C
Page 77 and 78:
Gateway-to-gateway configurations H
Page 79 and 80:
Gateway-to-gateway configurations H
Page 81 and 82:
Gateway-to-gateway configurations T
Page 83 and 84:
Gateway-to-gateway configurations T
Page 85 and 86:
FortiOS Handbook Hub-and-spoke conf
Page 87 and 88:
Hub-and-spoke configurations Config
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Hub-and-spoke configurations Dynami
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
FortiOS Handbook Dynamic DNS config
Page 103 and 104:
Dynamic DNS configuration Dynamic D
Page 105 and 106:
Dynamic DNS configuration Configure
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
FortiOS Handbook FortiClient dialup
Page 117 and 118:
FortiClient dialup-client configura
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
FortiGate dialup-client configurati
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
FortiOS Handbook Supporting IKE Mod
Page 143 and 144:
Supporting IKE Mode config clients
Page 145 and 146:
Supporting IKE Mode config clients
Page 147 and 148:
FortiOS Handbook Internet-browsing
Page 149 and 150:
Internet-browsing configuration Rou
Page 151 and 152:
FortiOS Handbook Redundant VPN conf
Page 153 and 154:
Redundant VPN configurations Config
Page 155 and 156:
Redundant VPN configurations Redund
Page 157 and 158:
Page 159 and 160:
Page 161 and 162:
Page 163 and 164:
Page 165 and 166:
Page 167 and 168:
Redundant VPN configurations Partia
Page 169 and 170:
Page 171 and 172:
Page 173 and 174:
Redundant VPN configurations Creati
Page 175 and 176:
FortiOS Handbook Transparent mode V
Page 177 and 178:
Transparent mode VPNs Configuration
Page 179 and 180:
Transparent mode VPNs Configure the
Page 181 and 182:
Transparent mode VPNs Configure the
Page 183 and 184:
FortiOS Handbook Manual-key configu
Page 185 and 186:
Manual-key configurations Specify t
Page 187 and 188:
IPv6 IPsec VPNs FortiOS Handbook Th
Page 189 and 190:
IPv6 IPsec VPNs Site-to-site IPv6 o
Page 191 and 192: IPv6 IPsec VPNs Site-to-site IPv6 o
Page 199 and 200: FortiOS Handbook L2TP and IPsec (Mi
Page 201 and 202: L2TP and IPsec (Microsoft VPN) Conf
Page 207 and 208: L2TP and IPsec (Microsoft VPN) Trou
Page 209 and 210: L2TP and IPsec (Microsoft VPN) Trou
Page 211 and 212: FortiOS Handbook GRE over IPsec (Ci
Page 213 and 214: GRE over IPsec (Cisco VPN) configur
Page 221 and 222: FortiOS Handbook Protecting OSPF wi
Page 223 and 224: Protecting OSPF with IPsec OSPF ove
Page 225 and 226: Protecting OSPF with IPsec OSPF ove
Page 227 and 228: Protecting OSPF with IPsec Creating
Page 229 and 230: FortiOS Handbook Hardware offloadin
Page 231 and 232: Hardware offloading and acceleratio
Page 233 and 234: Hardware offloading and acceleratio
Page 235 and 236: FortiOS Handbook Monitoring and tro
Page 237 and 238: Monitoring and troubleshooting Test
Page 239 and 240: Monitoring and troubleshooting Logg
Page 241: Monitoring and troubleshooting VPN
Page 245 and 246: IPcomp, 237 IPsec, 230 tunnel, 229
Page 247 and 248: security association (SA), 230 secu
show all

fortigate-ipsec-40-mr3

Create successful ePaper yourself

Delete template?

Save as template?