fortigate-ipsec-40-mr3
fortigate-ipsec-40-mr3
fortigate-ipsec-40-mr3
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
How to work with overlapping subnets Gateway-to-gateway configurations<br />
To configure IPsec Phase 2 - CLI<br />
config vpn <strong>ipsec</strong> phase2<br />
edit "FGT1_FGT2_p2"<br />
set keepalive enable<br />
set pfs enable<br />
set phase1name FGT1_to_FGT2<br />
set proposal 3des-sha1 3des-md5<br />
set replay enable<br />
set use-natip disable<br />
end<br />
In this example, your phase 1 definition is named FGT1_to_FGT2. use-natip is set to<br />
disable, so you can specify the source selector using the src-addr-type, srcstart-ip<br />
/ src-end-ip or src-subnet keywords. This example leaves these<br />
keywords at their default values, which specify the subnet 0.0.0.0/0.<br />
The pfs keyword ensures that perfect forward secrecy (PFS) is used. This ensures that<br />
each Phase 2 key created is unrelated to any other keys in use.<br />
To define the local private network firewall address<br />
1 Go to Firewall Objects > Address > Address.<br />
2 Select Create New and enter the following information:<br />
Address Name<br />
Enter vpn-local.<br />
A meaningful name for the local private network<br />
Type Subnet / IP Range<br />
Subnet / IP Range 10.11.101.0 255.255.255.0<br />
Interface Any<br />
To define the remote private network firewall address<br />
1 Go to Firewall Objects > Address > Address.<br />
2 Select Create New.<br />
3 Enter the following information, and select OK:<br />
Address Name<br />
Enter vpn-remote.<br />
A meaningful name for the remote private network.<br />
Type Subnet / IP Range<br />
Subnet / IP Range<br />
10.31.101.0 255.255.255.0 on FortiGate_1<br />
10.21.101.0 255.255.255.0 on FortiGate_2<br />
Interface Any<br />
IPsec VPNs for FortiOS 4.0 MR3<br />
80 01-434-112804-20120111<br />
http://docs.fortinet.com/
Change language