fortigate-ipsec-40-mr3

Configure the hub Hub-and-spoke configurations
To configure the VPN hub
1 At the hub, define the phase 1 configuration for each spoke. See “Auto Key phase 1
parameters” on page 39. Enter these settings in particular:
Name
Remote
Gateway
Local Interface
Enable IPsec
Interface Mode
2 Define the phase 2 parameters needed to create a VPN tunnel with each spoke. See
“Phase 2 parameters” on page 57. Enter these settings in particular:
Define the hub-spoke security policies
Enter a name to identify the VPN in phase 2 configurations,
security policies and the VPN monitor.
The remote gateway is the other end of the VPN tunnel. There are
three options:
Static IP Address — Enter the spoke’s public IP Address. You will
need to create a phase 1 configuration for each spoke. Either the
hub or the spoke can establish the VPN connection.
Dialup User — No additional information is needed. The hub
accepts connections from peers with appropriate encryption and
authentication settings. Only one phase 1 configuration is needed
for multiple dialup spokes. Only the spoke can establish the VPN
tunnel.
Dynamic DNS — If the spoke subscribes to a dynamic DNS
service, enter the spoke’s Dynamic DNS domain name. Either the
hub or the spoke can establish the VPN connection. For more
information, see “Dynamic DNS configuration” on page 101.
Select the FortiGate interface that connects to the remote
gateway. This is usually the FortiGate unit’s public interface.
This interface cannot be a loopback interface.
You must select Advanced to see this setting. If IPsec Interface
Mode is enabled, the FortiGate unit creates a virtual IPsec
interface for a route-based VPN. Disable this option if you want to
create a policy-based VPN. For more information, see “Comparing
policy-based or route-based VPNs” on page 22.
After you select OK to create the phase 1 configuration, you
cannot change this setting.
Name Enter a name to identify this spoke phase 2 configuration.
Phase 1
Select the name of the phase 1 configuration that you defined for
this spoke.
1 Define a name for the address of the private network behind the hub. For more
information, see “Defining policy addresses” on page 63.
2 Define names for the addresses or address ranges of the private networks behind the
spokes. For more information, see “Defining policy addresses” on page 63.
3 Define the VPN concentrator. See “To define the VPN concentrator” on page 90.
IPsec VPNs for FortiOS 4.0 MR3
88 01-434-112804-20120111
http://docs.fortinet.com/