fortigate-ipsec-40-mr3

FortiOS Handbook
Hub-and-spoke configurations
This section describes how to set up hub-and-spoke IPsec VPNs. The following topics
are included in this section:
Configuration overview
Configure the hub
Configure the spokes
Configuration overview
Dynamic spokes configuration example
In a hub-and-spoke configuration, VPN connections radiate from a central FortiGate unit
(the hub) to a number of remote peers (the spokes). Traffic can pass between private
networks behind the hub and private networks behind the remote peers. Traffic can also
pass between remote peer private networks through the hub.
Figure 10: Example hub-and-spoke configuration
HR network
Site_1
Hub Hub
Finance network
The actual implementation varies in complexity depending on
whether the spokes are statically or dynamically addressed
the addressing scheme of the protected subnets
how peers are authenticated
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 85
http://docs.fortinet.com/
Spoke_1 poke_1
Spoke_2 Spok
Site_2