fortigate-ipsec-40-mr3

IPsec VPN in the web-based manager
Keepalive
Frequency
Dead Peer
Detection
Phase 2 configuration
After IPsec phase 1 negotiations end successfully, you begin phase 2. You configure the
phase 2 parameters to define the algorithms that the FortiGate unit may use to encrypt
and transfer data for the remainder of the session. During phase 2, you select specific
IPsec security associations needed to implement security services and establish a
tunnel.
The basic phase 2 settings associate IPsec phase 2 parameters with the phase 1
configuration that specifies the remote end point of the VPN tunnel. In most cases, you
need to configure only basic phase 2 settings.
To configure Phase 2 settings, go to VPN > Auto Key (IKE) and select Create Phase 2.
Phase 2 advanced configuration settings
If you enabled NAT-traversal, enter a keepalive frequency setting.
Select this check box to reestablish VPN tunnels on idle
connections and clean up dead IKE peers if required. You can use
this option to receive notification whenever a tunnel goes up or
down, or to keep the tunnel connection open when no traffic is
being generated inside the tunnel. For example, in scenarios
where a dialup client or dynamic DNS peer connects from an IP
address that changes periodically, traffic may be suspended while
the IP address changes.
With Dead Peer Detection selected, you can use the config vpn
ipsec phase1 (tunnel mode) or config vpn ipsec phase1interface
(interface mode) CLI command to optionally specify
a retry count and a retry interval.
New Phase 2 page
Name Type a name to identify the phase 2 configuration.
Phase 1
Advanced
Select the phase 1 tunnel configuration. For more information on
configuring phase 1, see “Phase 1 configuration” on page 26. The
phase 1 configuration describes how remote VPN peers or clients will be
authenticated on this tunnel, and how the connection to the remote peer
or client will be secured.
Define advanced phase 2 parameters. For more information, see
“Phase 2 advanced configuration settings” on page 31.
In phase 2, the FortiGate unit and the VPN peer or client exchange keys again to
establish a secure communication channel between them. You select the encryption and
authentication algorithms needed to generate keys for protecting the implementation
details of Security Associations (SAs). These are called P2 Proposal parameters. The
keys are generated automatically using a Diffie-Hellman algorithm.
You can use a number of additional advanced phase 2 settings to enhance the operation
of the tunnel.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 31
http://docs.fortinet.com/