fortigate-ipsec-40-mr3

Accept this peer ID
Accept peer ID in
dialup group
Advanced
Phase 1 advanced configuration settings
IPsec VPN in the web-based manager
This option is available when Aggressive Mode is enabled. Enter
the identifier that is used to authenticate the remote peer. This
identifier must match the Local ID that the remote peer’s
administrator has configured.
If the remote peer is a FortiGate unit, the identifier is specified in
the Local ID field of the Advanced phase 1 configuration.
If the remote peer is a FortiClient user, the identifier is specified in
the Local ID field, accessed by selecting Config in the Policy
section of the VPN connection’s Advanced Settings.
Authenticate multiple FortiGate or FortiClient dialup clients that
use unique identifiers and unique pre-shared keys (or unique
pre-shared keys only) through the same VPN tunnel.
You must create a dialup user group for authentication purposes.
Select the group from the list next to the Accept peer ID in dialup
group option.
You must set Mode to Aggressive when the dialup clients use
unique identifiers and unique pre-shared keys. If the dialup clients
use unique pre-shared keys only, you can set Mode to Main if
there is only one dialup phase 1 configuration for this interface IP
address.
Defines advanced phase 1 parameters. For more information, see
Phase 1 advanced configuration settings.
You use the advanced parameters to select the encryption and authentication algorithms
that the FortiGate unit uses to generate keys for the IKE exchange. You can also select
these advanced settings to ensure the smooth operation of phase 1 negotiations.
To configure Phase 1settings, go to VPN > Auto Key (IKE) and select Create Phase 1.
Advanced section of the New Phase 1 page
Enable IPsec
Interface Mode
IKE Version
IPv6 Version
This is available in NAT mode only.
Create a virtual interface for the local end of the VPN tunnel.
Select this option to create a route-based VPN, clear it to create a
policy-based VPN.
Select the version of IKE to use. This is available only if IPsec
Interface Mode is enabled. For more information about IKE v2,
refer to RFC 4306.
IKE v2 is not available if Mode is Aggressive.
When IKE Version is 2, Mode and XAUTH are not available.
Select if you want to use IPv6 addresses for the remote gateway
and interface IP addresses. This is available only when Enable
IPsec Interface Mode is selected and IPv6 Support is enabled in
the administrative settings (System > Admin > Settings).
IPsec VPNs for FortiOS 4.0 MR3
28 01-434-112804-20120111
http://docs.fortinet.com/