fortigate-ipsec-40-mr3

IPsec VPN in the web-based manager
Local Interface
Mode
Authentication
Method
Pre-shared Key
Certificate Name
Peer Options
Accept any peer ID
This option is available in NAT mode only. Select the name of the
interface through which remote peers or dialup clients connect to
the FortiGate unit.
By default, the local VPN gateway IP address is the IP address of
the interface that you selected. Optionally, you can specify a
unique IP address for the VPN gateway in the Advanced settings.
Select Main (ID Protection) or Aggressive:
Main mode — the phase 1 parameters are exchanged in
multiple rounds with encrypted authentication information.
Aggressive mode — the phase 1 parameters are exchanged in
single message with authentication information that is not
encrypted.
When the remote VPN peer has a dynamic IP address and is
authenticated by a pre-shared key, you must select Aggressive
mode if there is more than one dialup phase1 configuration for the
interface IP address.
When the remote VPN peer has a dynamic IP address and is
authenticated by a certificate, you must select Aggressive mode if
there is more than one phase 1 configuration for the interface IP
address and these phase 1 configurations use different proposals.
Select Preshared Key or RSA Signature.
If you selected Pre-shared Key, enter the pre-shared key that the
FortiGate unit will use to authenticate itself to the remote peer or
dialup client during phase 1 negotiations. You must define the
same key at the remote peer or client. The key must contain at
least 6 printable characters. For optimum protection against
currently known attacks, the key must consist of a minimum of 16
randomly chosen alphanumeric characters.
If you selected RSA Signature, select the name of the server
certificate that the FortiGate unit will use to authenticate itself to
the remote peer or dialup client during phase 1 negotiations. For
information about obtaining and loading the required server
certificate, see the FortiOS User Authentication guide.
Peer options are available to authenticate VPN peers or clients,
depending on the Remote Gateway and Authentication Method
settings.
Accept the local ID of any remote VPN peer or client. The
FortiGate unit does not check identifiers (local IDs). You can set
Mode to Aggressive or Main.
You can use this option with RSA Signature authentication. But,
for highest security, configure a PKI user/group for the peer and
set Peer Options to Accept this peer certificate only.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 27
http://docs.fortinet.com/