fortigate-ipsec-40-mr3

Authenticating the FortiGate unit Auto Key phase 1 parameters
Local Interface
Mode
Authentication
Method
Certificate Name
Peer Options
Advanced
4 If you are configuring authentication parameters for a dialup user group, optionally
define extended authentication (XAuth) parameters in the Advanced section. See
“Using the FortiGate unit as an XAuth server” on page 54.
5 Select OK.
Authenticating the FortiGate unit with a pre-shared key
Select the interface that is the local end of the IPsec tunnel.
For more information, see “Defining the tunnel ends” on
page 40.
This interface cannot be a loopback interface.
Select amode. It is easier to use aggressive mode.
In Main mode, parameters are exchanged in multiple
encrypted rounds.
In Aggressive mode, parameters are exchanged in a
single unencrypted message.
Aggressive mode must be used when the remote VPN peer
or client has a dynamic IP address, or the remote VPN peer
or client will be authenticated using an identifier (local ID).
For more information, see “Choosing main mode or
aggressive mode” on page 40.
Select RSA Signature.
Select the name of the server certificate that the FortiGate
unit will use to authenticate itself to the remote peer or
dialup client during phase 1 negotiations.
You must obtain and load the required server certificate
before this selection. See the FortiOS User Authentication
guide. If you have not loaded any certificates, use the
certificate named Fortinet_Factory.
Peer options define the authentication requirements for
remote peers or dialup clients. They are not for your
FortiGate unit itself.
See “Authenticating remote peers and clients” on page 44.
You can use the default settings for most phase 1
configurations. Changes are required only if your network
requires them. These settings includes IKE version, DNS
server, P1 proposal encryption and authentication settings,
and XAuth settings. See “Defining IKE negotiation
parameters” on page 49.
The simplest way to authenticate a FortiGate unit to its remote peers or dialup clients is
by means of a pre-shared key. This is less secure than using certificates, especially if it is
used alone, without requiring peer IDs or extended authentication (XAuth). Also, you need
to have a secure way to distribute the pre-shared key to the peers.
IPsec VPNs for FortiOS 4.0 MR3
42 01-434-112804-20120111
http://docs.fortinet.com/