fortigate-ipsec-40-mr3

Defining IKE negotiation parameters Auto Key phase 1 parameters
DH Group
Keylife
Nat-traversal
Keepalive
Frequency
Dead Peer
Detection
4 Select OK.
NAT traversal
Select one or more Diffie-Hellman groups from DH group 1, 2,
and 5. When using aggressive mode, DH groups cannot be
negotiated.
If both VPN peers (or a VPN server and its client) have static IP
addresses and use aggressive mode, select a single DH
group. The setting on the FortiGate unit must be identical to
the setting on the remote peer or dialup client.
When the remote VPN peer or client has a dynamic IP address
and uses aggressive mode, select up to three DH groups on
the FortiGate unit and one DH group on the remote peer or
dialup client. The setting on the remote peer or dialup client
must be identical to one of the selections on the FortiGate
unit.
If the VPN peer or client employs main mode, you can select
multiple DH groups. At least one of the settings on the remote
peer or dialup client must be identical to the selections on the
FortiGate unit.
Type the amount of time (in seconds) that will be allowed to
pass before the IKE encryption key expires. When the key
expires, a new key is generated without interrupting service.
The keylife can be from 120 to 172800 seconds.
Enable this option if a NAT device exists between the local
FortiGate unit and the VPN peer or client. The local FortiGate
unit and the VPN peer or client must have the same NAT
traversal setting (both selected or both cleared). When in
doubt, enable NAT-traversal. See “NAT traversal” on page 52.
If you enabled NAT traversal, enter a keepalive frequency
setting. The value represents an interval from 0 to 900
seconds where the connection will be maintained with no
activity. For additional security this value must be as low as
possible. See “NAT keepalive frequency” on page 53.
Enable this option to reestablish VPN tunnels on idle
connections and clean up dead IKE peers if required. This
feature minimizes the traffic required to check if a VPN peer is
available or unavailable (dead). See “Dead peer detection” on
page 53.
Network Address Translation (NAT) is a way to convert private IP addresses to publicly
routable Internet addresses and vise versa. When an IP packet passes through a NAT
device, the source or destination address in the IP header is modified. FortiGate units
support NAT version 1 (encapsulate on port 500 with non-IKE marker), version 3
(encapsulate on port 4500 with non-ESP marker), and compatible versions.
IPsec VPNs for FortiOS 4.0 MR3
52 01-434-112804-20120111
http://docs.fortinet.com/