fortigate-ipsec-40-mr3

IPsec VPN in the web-based manager
Manual Key
Use manual keys only if it is unavoidable. There are potential difficulties in keeping keys
confidential and in propagating changed keys to remote VPN peers securely.
If required, you can manually define cryptographic keys for establishing an IPsec VPN
tunnel. You would define manual keys in situations where:
you require prior knowledge of the encryption or authentication key (that is, one of the
VPN peers requires a specific IPsec encryption or authentication key).
you need to disable encryption and authentication.
In both cases, you do not specify IPsec phase 1 and phase 2 parameters; you define
manual keys by going to VPN > IPsec > Manual Key instead.
Manual key configuration settings
If you are not familiar with the security policies, SAs, selectors, and SA databases for your
particular installation, do not attempt these procedures without qualified assistance.
If one of the VPN devices is manually keyed, the other VPN device must also be manually
keyed with the identical authentication and encryption keys. In addition, it is essential
that both VPN devices be configured with complementary Security Parameter Index (SPI)
settings. The administrators of the devices need to cooperate to achieve this.
Each SPI identifies a Security Association (SA). The value is placed in ESP datagrams to
link the datagrams to the SA. When an ESP datagram is received, the recipient refers to
the SPI to determine which SA applies to the datagram. You must manually specify an
SPI for each SA. There is an SA for each direction, so for each VPN you must specify two
SPIs, a local SPI and a remote SPI, to cover bidirectional communications between two
VPN devices.
To add a manual key, go to VPN > IPsec > Manual Key and select Create New.
New Manual Key page
Name
Local SPI
Remote SPI
Remote
Gateway
Type a name for the VPN tunnel. The maximum name length is 15
characters for an interface mode VPN, 35 characters for a policybased
VPN.
Type a hexadecimal number (up to 8 characters, 0-9, a-f) that
represents the SA that handles outbound traffic on the local FortiGate
unit. The valid range is from 0x100 to 0xffffffff. This value must
match the Remote SPI value in the manual key configuration at the
remote peer.
Type a hexadecimal number (up to 8 characters, 0-9, a-f) that
represents the SA that handles inbound traffic on the local FortiGate
unit. The valid range is from 0x100 to 0xffffffff. This value must
match the Local SPI value in the manual key configuration at the
remote peer.
Enter the IP address of the public interface to the remote peer. The
address identifies the recipient of ESP datagrams.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 35
http://docs.fortinet.com/