fortigate-ipsec-40-mr3

Hub-and-spoke configurations Configure the hub
4 Define security policies to permit communication between the hub and the spokes.
For more information, see “Defining VPN security policies” on page 64.
Route-based VPN security policies
Define ACCEPT security policies to permit communications between the hub and the
spoke. You need one policy for each direction. Enter these settings in particular:
Source Interface/Zone
Select the VPN Tunnel (IPsec Interface) you configured in
Step 1.
Source Address Name
Select the address name you defined in Step 2 for the
private network behind the spoke FortiGate unit.
Destination
Interface/Zone
Select the hub’s interface to the internal (private) network.
Destination Address
Name
Select the source address that you defined in Step 1.
Action Select ACCEPT.
NAT Enable.
Source Interface/Zone
Select the address name you defined in Step 2 for the
private network behind the spoke FortiGate units.
Source Address Name
Select the VPN Tunnel (IPsec Interface) you configured in
Step 1.
Destination
Interface/Zone
Select the source address that you defined in Step 1.
Destination Address
Name
Select the hub’s interface to the internal (private) network.
Action Select ACCEPT.
NAT Enable.
Policy-based VPN security policy
Define an IPsec security policy to permit communications between the hub and the
spoke. Enter these settings in particular:
Source Interface/Zone
Select the hub’s interface to the internal (private)
network.
Source Address Name Select the source address that you defined in Step 1.
Destination
Interface/Zone
Select the hub’s public network interface.
Destination Address
Name
Action IPSEC
VPN Tunnel
Select the address name you defined in Step 2 for the
private network behind the spoke FortiGate unit.
Select the name of the phase 1 configuration that you
created for the spoke in Step 1.
Select Allow inbound to enable traffic from the remote
network to initiate the tunnel.
Select Allow outbound to enable traffic from the local
network to initiate the tunnel.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 89
http://docs.fortinet.com/