fortigate-ipsec-40-mr3

Configure the phase 2 parameters Phase 2 parameters
There are some configurations that require specific selectors:
the VPN peer is a third-party device that uses specific phase2 selectors
the FortiGate unit connects as a dialup client to another FortiGate unit, in which case
you must specify a source IP address, IP address range or subnet
With FortiOS VPNs, your network has multiple layers of security, with quick mode
selectors being an important line of defence.
Routes guide traffic from one IP address to another.
Phase 1 and phase 2 connection settings ensure there is a valid remote end point for
the VPN tunnel that agrees on the encryption and parameters.
Quick mode selectors allow IKE negotiations only for allowed peers.
Security policies control which IP addresses can connect to the VPN.
Security policies also control what protocols are allowed over the VPN along with any
bandwidth limiting.
Configure the phase 2 parameters
Follow this procedure to create an IPsec phase 2 definition.
If you are creating a hub-and-spoke configuration or an Internet-browsing configuration,
you may have already started defining some of the required phase 2 parameters. If so,
edit the existing definition to complete the configuration.
Specifying the phase 2 parameters
1 Go to VPN > IPsec > Auto Key (IKE).
2 Select Create Phase 2.
3 Include appropriate entries as follows:
Name Enter a name to identify the phase 2 configuration.
Phase 1
Select the phase 1 configuration that describes how remote peers or
dialup clients will be authenticated on this tunnel, and how the
connection to the remote peer or dialup client will be secured.
4 Select Advanced.
5 Include appropriate entries as follows:
P2 Proposal
Select the encryption and authentication algorithms that will be
used to change data into encrypted code.
Add or delete encryption and authentication algorithms as required.
Select a minimum of one and a maximum of three combinations.
The remote peer must be configured to use at least one of the
proposals that you define.
It is invalid to set both Encryption and Authentication to null.
IPsec VPNs for FortiOS 4.0 MR3
60 01-434-112804-20120111
http://docs.fortinet.com/