fortigate-ipsec-40-mr3

O
OSPF
protecting with IPsec, 221
with redundant IPsec tunnels, 227
Outbound NAT, encryption policy, 65
overlap
resolving IP address, 134
resolving through FortiGate DHCP relay, 134
overlapping VPN subnets, 76
P
P1 Proposal, Phase 1, 49, 51
P2 Proposal
IPSec VPN, phase 2, 32
P2 Proposal, Phase 2, 58
partially meshed VPN, 69
Password Authentication Protocol (PAP), 55
peer ID
assigning to FortiGate unit, 46
enabling, 47
Peer option
IPSec VPN, phase 1, 27
Peer Options, 41
perfect forward secrecy (PFS), 80
perfect forward secrecy, enabling, 58
Phase, 31
phase 1
IPSec VPN, 26, 31
phase 1 advanced options
IPSec VPN, 28
phase 1 parameters
authenticating with certificates, 41
authenticating with preshared keys, 42
authentication method, 44
authentication options, 44
defining, 39
defining the tunnel ends, 40
IKE proposals, 50
main or aggressive mode, 40
negotiating, 49
overview, 39
peer identifiers, 46
user accounts, 47
phase 2
Autokey keep alive, 59
IPSec VPN, 31
key expires, 58
PFS, 80
phase 2 advanced options
IPSec VPN, 31
phase 2 parameters
autokey keep alive, 59
auto-negotiate, 58
configuring, 60
defining, 57
DHCP-IPsec, 59
keylife, 58
negotiating, 58
perfect forward secrecy (PFS), 58
quick mode selectors, 59
replay detection, 58
Phase I, 229
Phase II, 230
planning VPN configuration, 22
policy server, VPN
configuring FortiGate unit as, 123
policy-based VPN
vs. route-based, 22
port 1701, 200
port 4500, 52
port 500, 52
pre-shared key
authenticating FortiGate unit with, 43
preshared key, 17
Pre-shared Key, Phase 1, 43
proposal
IPSec VPN, phase 2, 32
IPsec VPNs for FortiOS 4.0 MR3
246 01-434-112804-20120111
http://docs.fortinet.com/
Q
Quick mode selectors, Phase 2, 59
R
RADIUS, 144
assigning client IPs with, 119
RADIUS server, external
for XAuth, 54
redundant VPNs
configuration, 152
example, fully redundant configuration, 155
example, partially-redundant configuration, 166
overview, 151
remote client
authenticating with certificates, 41
FortiGate dialup-client, 133
in Internet-browsing IPsec configuration, 147
Remote Gateway
IPSec manual key setting, 35
remote gateway
dialup user, 59
Remote Gateway, Phase 1, 41, 43
remote peer
authenticating with certificates, 41
dynamic DNS configuration, 110
gateway-to-gateway IPsec configuration, 71
manual key configuration, 35
manual key IPsec configuration, 183
transparent IPsec VPN configuration, 176
Remote SPI
IPSec VPN, manual key, 35
Remote SPI, Manual Key, 184
replay detection, 230
replay detection, enabling, 58
RFC 317, 237
route-based VPN
firewall policy, 68
vs. policy-based, 22
routing, transparent VPN IPsec configuration, 178
S
Security Association (SA), 58, 183
Index