fortigate-ipsec-40-mr3

Configure the hub Hub-and-spoke configurations
5 In the policy list, arrange the policies in the following order:
IPsec policies that control traffic between the hub and the spokes first
the default security policy last
Configuring communication between spokes (policy-based VPN)
For a policy-based hub-and-spoke VPN, you define a concentrator to enable
communication between the spokes.
To define the VPN concentrator
1 At the hub, go to VPN > IPSEC > Concentrator and select Create New.
2 In the Concentrator Name field, type a name to identify the concentrator.
3 From the Available Tunnels list, select a VPN tunnel and then select the right-pointing
arrow.
To remove tunnels from the VPN concentrator, select the tunnel in the Members list and
select the left-pointing arrow.
4 Repeat Step 3 until all of the tunnels associated with the spokes are included in the
concentrator.
5 Select OK.
Configuring communication between spokes (route-based VPN)
For a route-based hub-and-spoke VPN, there are several ways you can enable
communication between the spokes:
put all of the IPsec interfaces into a zone and enable intra-zone traffic. This eliminates
the need for any security policy for the VPN, but you cannot apply UTM features to
scan the traffic for security threats.
put all of the IPsec interfaces into a zone and create a single zone-to-zone security
policy
create a security policy for each pair of spokes that are allowed to communicate with
each other. The number of policies required increases rapidly as the number of spokes
increases.
Using a zone as a concentrator
A simple way to provide communication among all of the spokes is to create a zone and
allow intra-zone communication. You cannot apply UTM features using this method.
1 Go to System > Network > Interface.
2 Select the down-arrow on the Create New button and select Zone.
3 In the Zone Name field, enter a name, such as Our_VPN_zone.
4 Clear Block intra-zone traffic.
5 In the Interface Members list, select the IPsec interfaces that are part of your VPN.
6 Select OK.
IPsec VPNs for FortiOS 4.0 MR3
90 01-434-112804-20120111
http://docs.fortinet.com/