fortigate-ipsec-40-mr3

Defining the tunnel ends Auto Key phase 1 parameters
Defining the tunnel ends
If you want to control how the IKE negotiation process controls traffic when there is no
traffic, as well as the length of time the unit waits for negotiations to occur, use the
negotiation-timeout and auto-negotiation commands in the CLI.
To begin defining the phase 1 configuration, go to VPN > IPsec > Auto Key (IKE) and
select Create Phase 1. Enter a descriptive name for the VPN tunnel. This is particularly
important if you will create several tunnels.
The phase 1 configuration mainly defines the ends of the IPsec tunnel. The remote end is
the remote gateway with which the FortiGate unit exchanges IPsec packets. The local
end is the FortiGate interface that sends and receives IPsec packets.
The remote gateway can be:
a static IP address
a domain name with a dynamic IP address
a dialup client
A statically addressed remote gateway is the simplest to configure. You specify the IP
address. Unless restricted in the security policy, either the remote peer or a peer on the
network behind the FortiGate unit can bring up the tunnel.
If the remote peer has a domain name and subscribes to a dynamic DNS service, you
need to specify only the domain name. The FortiGate unit performs a DNS query to
determine the appropriate IP address. Unless restricted in the security policy, either the
remote peer or a peer on the network behind the FortiGate unit can bring up the tunnel.
If the remote peer is a dialup client, only the dialup client can bring up the tunnel. The IP
address of the client is not known until it connects to the FortiGate unit. This
configuration is a typical way to provide a VPN for client PCs running VPN client software
such as the FortiClient Endpoint Security application.
The local end of the VPN tunnel, the Local Interface, is the FortiGate interface that sends
and receives the IPsec packets. This is usually the public interface of the FortiGate unit
that is connected to the Internet. Packets from this interface pass to the private network
through a security policy.
The local Interface for a Phase 1 cannot not be a loopback interface. By design, the IPSec
tunnel will not be established if this happens.
By default, the local VPN gateway is the IP address of the selected Local Interface. If you
are configuring an interface mode VPN, you can optionally use a secondary IP address of
the Local Interface as the local gateway.
Choosing main mode or aggressive mode
The FortiGate unit and the remote peer or dialup client exchange phase 1 parameters in
either Main mode or Aggressive mode. This choice does not apply if you use IKE
version 2, which is available only for route-based configurations.
In Main mode, the phase 1 parameters are exchanged in multiple rounds with
encrypted authentication information
IPsec VPNs for FortiOS 4.0 MR3
40 01-434-112804-20120111
http://docs.fortinet.com/