fortigate-ipsec-40-mr3

Hub-and-spoke configurations Configure the hub
Authentication
Configure the hub
Each spoke uses the address of its own protected subnet as the IPsec source selector
and as the source address in its VPN security policy. The remote gateway is the public IP
address of the hub FortiGate unit.
Using an address group
If you want to create a hub-and-spoke VPN between existing private networks, the
subnet addressing usually does not fit the aggregated subnet model discussed earlier. All
of the spokes and the hub will need to include the addresses of all the protected
networks in their configuration.
On FortiGate units, you can define a named firewall address for each of the remote
protected networks and add these addresses to a firewall address group. For a policybased
VPN, you can then use this address group as the destination of the VPN security
policy.
For a route-based VPN, the destination of the VPN security policy can be set to All. You
need to specify appropriate routes for each of the remote subnets.
Authentication is by a common preshared key or by certificates. For simplicity, the
examples in this chapter assume that all spokes use the same preshared key.
At the FortiGate unit that acts as the hub, you need to
configure the VPN to each spoke
configure communication between spokes
You configure communication between spokes differently for a policy-based VPN than for
a route-based VPN. For a policy-based VPN, you configure a VPN concentrator. For a
route-based VPN, you must either define security policies or group the IPsec interfaces
into a zone
Define the hub-spoke VPNs
Perform these steps at the FortiGate unit that will act as the hub. Although this procedure
assumes that the spokes are all FortiGate units, a spoke could also be VPN client
software, such as FortiClient Endpoint Security.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 87
http://docs.fortinet.com/