fortigate-ipsec-40-mr3

Phase 2 parameters Advanced phase 2 settings
Autokey Keep Alive
DHCP-IPsec
When enabled, auto-negotiate initiates the phase 2 SA negotiation automatically,
repeating every five seconds until the SA is established.
The auto-negotiate feature is available only through the Command Line Interface (CLI).
Use the following commands to enable it.
config vpn ipsec phase2
edit
set auto-negotiate enable
end
If the tunnel goes down, the auto-negotiate feature will attempt to re-establish it.
However, the Autokey Keep Alive feature is a better method to ensure your VPN remains
up.
The phase 2 SA has a fixed duration. If there is traffic on the VPN as the SA nears expiry,
a new SA is negotiated and the VPN switches to the new SA without interruption. If there
is no traffic, the SA expires and the VPN tunnel goes down. A new SA will not be
generated until there is traffic.
The Autokey Keep Alive option ensures that a new SA is negotiated even if there is no
traffic so that the VPN tunnel stays up.
Select this option if the FortiGate unit assigns VIP addresses to FortiClient dialup clients
through a DHCP server or relay. This option is available only if the Remote Gateway in the
phase 1 configuration is set to Dialup User and it works only on policy-based VPNs.
With the DHCP-IPsec option, the FortiGate dialup server acts as a proxy for FortiClient
dialup clients that have VIP addresses on the subnet of the private network behind the
FortiGate unit. In this case, the FortiGate dialup server acts as a proxy on the local private
network for the FortiClient dialup client. When a host on the network behind the dialup
server issues an ARP request that corresponds to the device MAC address of the
FortiClient host (when a remote server sends an ARP to the local FortiClient dialup client),
the FortiGate unit answers the ARP request on behalf of the FortiClient host and forwards
the associated traffic to the FortiClient host through the tunnel.
This feature prevents the VIP address assigned to the FortiClient dialup client from
causing possible arp broadcast problems—the normal and VIP addresses can confuse
some network switches by two addresses having the same MAC address.
Quick mode selectors
Quick Mode selectors determine which IP addresses can perform IKE negotiations to
establish a tunnel. By only allowing authorized IP addresses access to the VPN tunnel,
the network is more secure.
The default settings are as broad as possible: any IP address or configured address
group, using any protocol, on any port. This enables configurations in which multiple
subnets at each end of the tunnel can communicate, limited only by the security policies
at each end.
When configuring Quick Mode selector Source Address and Destination address, valid
options include IPv4 and IPv6 single addresses, IPv4 firewall address or group name,
IPv4 range, IPv6 range, IPv4 subnet, or IPv6 subnet. For more information on IPv6 IPsec
VPN, see “Overview of IPv6 IPsec support” on page 187.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 59
http://docs.fortinet.com/