fortigate-ipsec-40-mr3

Configuring the two VPN peers Gateway-to-gateway configurations
To create phase 1 to establish a secure connection with the remote peer
1 Go to VPN > IPsec > Auto Key (IKE).
2 Select Create Phase 1.
3 Enter the following information, and select OK.
The basic phase 2 settings associate IPsec phase 2 parameters with the phase 1
configuration and specify the remote end point of the VPN tunnel. Before you define the
phase 2 parameters, you need to reserve a name for the tunnel. See “Phase 2
configuration” on page 31.
To configure phase 2 settings
1 Go to VPN > IPsec > Auto Key (IKE).
2 Select Create Phase 2.
3 Enter the following information, and select OK.
Creating security policies
Enter peer_1.
Name
A name to identify the VPN tunnel. This name appears in
phase 2 configurations, security policies and the VPN monitor.
Remote Gateway Select Static IP Address.
IP Address
Local Interface
Enable IPsec
Interface Mode
Name
Phase 1
Enter 172.20.0.2 when configuring FortiGate_1.
Enter 172.18.0.2 when configuring FortiGate_2.
The IP address of the remote peer public interface.
Select wan1.
The FortiGate unit’s public interface.
This interface cannot be a loopback interface.
Select Advanced to see this setting.
Enable IPsec Interface Mode to have the FortiGate unit create a
virtual IPsec interface for a route-based VPN.
Disable this option to create a policy-based VPN. For more
information, see “Comparing policy-based or route-based
VPNs” on page 22.
After you select OK to create the phase 1 configuration, you
cannot change this setting.
Enter peer_1_p2.
A name to identify this phase 2 configuration.
Select peer_1.
The name of the phase 1 configuration.
Security policies control all IP traffic passing between a source address and a destination
address.
IPsec VPNs for FortiOS 4.0 MR3
72 01-434-112804-20120111
http://docs.fortinet.com/