fortigate-ipsec-40-mr3

Configure the spokes Hub-and-spoke configurations
3 Select OK.
Configure the spokes
NAT Enable.
UTM
If you want to apply UTM features to this traffic, select
the appropriate profiles.
Although this procedure assumes that the spokes are all FortiGate units, a spoke could
also be VPN client software, such as FortiClient Endpoint Security.
Perform these steps at each FortiGate unit that will act as a spoke.
To create the phase 1 and phase_2 configurations
1 At the spoke, define the phase 1 parameters that the spoke will use to establish a
secure connection with the hub. See “Auto Key phase 1 parameters” on page 39.
Enter these settings:
Remote Gateway Select Static IP Address.
IP Address
Enable IPsec
Interface Mode
Type the IP address of the interface that connects to the
hub.
Enable if you are creating a route-based VPN.
Clear if you are creating a policy-based VPN.
2 Create the phase 2 tunnel definition. See “Phase 2 parameters” on page 57. Select
the set of phase 1 parameters that you defined for the hub. You can select the name
of the hub from the Static IP Address part of the list.
Configuring security policies for hub-to-spoke communication
1 Create an address for this spoke. See “Defining policy addresses” on page 63. Enter
the IP address and netmask of the private network behind the spoke.
2 Create an address to represent the hub. See “Defining policy addresses” on page 63.
Enter the IP address and netmask of the private network behind the hub.
3 Define the security policy to enable communication with the hub.
Route-based VPN security policy
Define two security policies to permit communications to and from the hub. Enter
these settings:
Source Interface/Zone Select the virtual IPsec interface you created.
Source Address Name Select the hub address you defined in Step 1.
Destination
Select the spoke’s interface to the internal (private)
Interface/Zone
network.
Destination Address
Name
Select the spoke addresses you defined in Step 2.
Action Select ACCEPT
NAT Enable
IPsec VPNs for FortiOS 4.0 MR3
92 01-434-112804-20120111
http://docs.fortinet.com/