fortigate-ipsec-40-mr3

Authenticating remote peers and clients Auto Key phase 1 parameters
4 From the Certificate Name list, select the name of the server certificate that the
FortiGate unit will use to authenticate itself to the remote peer or dialup client
5 Under Peer Options, select one of these options:
To accept a specific certificate holder, select Accept this peer certificate only and
select the name of the certificate that belongs to the remote peer or dialup client.
The certificate DN must be added to the FortiGate configuration through CLI
commands before it can be selected here. See “Before you begin” on page 44.
To accept dialup clients who are members of a certificate group, select Accept this
peer certificate group only and select the name of the group. The group must be
added to the FortiGate configuration through CLI commands before it can be
selected here. See “Before you begin” on page 44.
6 If you want the FortiGate VPN server to supply the DN of a local server certificate for
authentication purposes, select Advanced and then from the Local ID list, select the
DN of the certificate that the FortiGate VPN server is to use.
7 Select OK.
Enabling VPN access by peer identifier
Whether you use certificates or pre-shared keys to authenticate the FortiGate unit, you
can require that remote peers or clients have a particular peer ID. This adds another piece
of information that is required to gain access to the VPN. More than one
FortiGate/FortiClient dialup client may connect through the same VPN tunnel when the
dialup clients share a preshared key and assume the same identifier.
A peer ID, also called local ID, can be up to 63 characters long containing standard
regular expression characters. Local ID is set in phase1 Aggressive Mode configuration.
You cannot require a peer ID for a remote peer or client that uses a pre-shared key and
has a static IP address.
To authenticate remote peers or dialup clients using one peer ID
1 At the FortiGate VPN server, go to VPN > IPsec > Auto Key (IKE).
2 In the list, select a phase 1 configuration and edit its parameters.
3 Select Aggressive mode in any of the following cases:
the FortiGate VPN server authenticates a FortiGate dialup client that uses a
dedicated tunnel
a FortiGate unit has a dynamic IP address and subscribes to a dynamic DNS
service
FortiGate/FortiClient dialup clients sharing the same preshared key and local ID
connect through the same VPN tunnel
4 Select Accept this peer ID and type the identifier into the corresponding field.
5 Select OK.
To assign an identifier (local ID) to a FortiGate unit
Use this procedure to assign a peer ID to a FortiGate unit that acts as a remote peer or
dialup client.
1 Go to VPN > IPsec > Auto Key (IKE).
2 In the list, select a phase 1 configuration and edit its parameters.
3 Select Advanced.
4 In the Local ID field, type the identifier that the FortiGate unit will use to identify itself.
IPsec VPNs for FortiOS 4.0 MR3
46 01-434-112804-20120111
http://docs.fortinet.com/