fortigate-ipsec-40-mr3

FortiOS Handbook
Auto Key phase 1 parameters
Overview
This chapter provides detailed step-by-step procedures for configuring a FortiGate unit
to accept a connection from a remote peer or dialup client. The phase 1 parameters
identify the remote peer or clients and support authentication through preshared keys or
digital certificates. You can increase access security further using peer identifiers,
certificate distinguished names, group names, or the FortiGate extended authentication
(XAuth) option for authentication purposes.
For more information on phase 1 parameters in the web-based manager, see “Phase 1
configuration” on page 26.
The information and procedures in this section do not apply to VPN peers that perform
negotiations using manual keys. Refer to “Manual-key configurations” on page 183
instead.
The following topics are included in this section:
Overview
Defining the tunnel ends
Choosing main mode or aggressive mode
Authenticating the FortiGate unit
Authenticating remote peers and clients
Defining IKE negotiation parameters
Using XAuth authentication
To configure IPsec phase 1 settings, go to VPN > IPsec > Auto Key (IKE) and select
Create Phase 1. IPsec phase 1 settings define:
the remote and local ends of the IPsec tunnel
if phase 1 parameters are exchanged in multiple rounds with encrypted authentication
information (main mode) or in a single message with authentication information that is
not encrypted (aggressive mode)
if a preshared key or digital certificates will be used to authenticate the FortiGate unit
to the VPN peer or dialup client
if the VPN peer or dialup client is required to authenticate to the FortiGate unit. A
remote peer or dialup client can authenticate by peer ID or, if the FortiGate unit
authenticates by certificate, it can authenticate by peer certificate.
the IKE negotiation proposals for encryption and authentication
optional XAuth authentication, which requires the remote user to enter a user name
and password. A FortiGate VPN server can act as an XAuth server to authenticate
dialup users. A FortiGate unit that is a dialup client can also be configured as an XAuth
client to authenticate itself to the VPN server.
For all the phase 1 web-based manager fields, see “Phase 1 configuration” on page 26.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 39
http://docs.fortinet.com/