fortigate-ipsec-40-mr3

Auto Key phase 1 parameters Authenticating the FortiGate unit
If you use pre-shared key authentication alone, all remote peers and dialup clients must
be configured with the same pre-shared key. Optionally, you can configure remote peers
and dialup clients with unique pre-shared keys. On the FortiGate unit, these are
configured in user accounts, not in the phase_1 settings. For more information, see
“Enabling VPN access with user accounts and pre-shared keys” on page 47.
The pre-shared key must contain at least 6 printable characters and best practices
dictate that it be known only to network administrators. For optimum protection against
currently known attacks, the key must consist of a minimum of 16 randomly chosen
alphanumeric characters.
If you authenticate the FortiGate unit using a pre-shared key, you can require remote
peers or dialup clients to authenticate using peer IDs, but not client certificates.
To authenticate the FortiGate unit with a pre-shared key
1 Go to VPN > IPsec > Auto Key (IKE).
2 Create a new phase 1 configuration or edit an existing phase 1 configuration.
3 Include appropriate entries as follows:
Name
Remote Gateway
Local Interface
Enter a name that reflects the origination of the remote
connection.
Select the nature of the remote connection. For more
information, see “Defining the tunnel ends” on page 40.
Select the interface that is the local end of the IPsec
tunnel. For more information, see “Defining the tunnel
ends” on page 40.
Select Main or Aggressive mode.
In Main mode, the phase 1 parameters are exchanged
in multiple rounds with encrypted authentication
information.
In Aggressive mode, the phase 1 parameters are
exchanged in single message with authentication
information that is not encrypted.
Mode
When the remote VPN peer or client has a dynamic IP
address, or the remote VPN peer or client will be
authenticated using an identifier (local ID), you must select
Aggressive mode if there is more than one dialup phase 1
configuration for the interface IP address.
For more information, see “Choosing main mode or
aggressive mode” on page 40.
Authentication Method Select Pre-shared Key.
Pre-shared Key
Enter the preshared key that the FortiGate unit will use to
authenticate itself to the remote peer or dialup client
during phase 1 negotiations. You must define the same
value at the remote peer or client. The key must contain at
least 6 printable characters and best practices dictate that
it only be known by network administrators. For optimum
protection against currently known attacks, the key must
consist of a minimum of 16 randomly chosen
alphanumeric characters.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 43
http://docs.fortinet.com/