fortigate-ipsec-40-mr3

Configure the spokes Hub-and-spoke configurations
2 Define the security policy to enable communication between this spoke and the
spokes in the address group you created.
Policy-based VPN security policy
Define an IPsec security policy to permit communications with the other spokes. See
“Defining VPN security policies” on page 64. Enter these settings in particular:
Route-based VPN security policy
Define two security policies to permit communications to and from the other spokes.
Enter these settings in particular:
Source Interface/Zone Select the virtual IPsec interface you created.
Source Address Name Select the spoke address group you defined in Step 1.
Destination
Select the spoke’s interface to the internal (private)
Interface/Zone
network.
Destination Address
Name
Select this spoke’s address name.
Action Select ACCEPT
NAT Enable
Source Interface/Zone
Select the spoke’s interface to the internal (private)
network.
Source Address Name Select this spoke’s address name.
Destination
Interface/Zone
Select the virtual IPsec interface you created.
Destination Address
Name
Select the spoke address group you defined in Step 1.
Action Select ACCEPT
NAT Enable
Policy-based VPN security policy
Source Interface/Zone Select this spoke’s internal (private) network interface.
Source Address Name Select this spoke’s source address.
Destination
Select the spoke’s interface to the external (public)
Interface/Zone
network.
Destination Address
Name
Select the spoke address group you defined in Step 1.
Action Select IPSEC
VPN Tunnel
Select the name of the phase 1 configuration you
defined.
Select Allow inbound to enable traffic from the remote
network to initiate the tunnel.
Select Allow outbound to enable traffic from the local
network to initiate the tunnel.
IPsec VPNs for FortiOS 4.0 MR3
94 01-434-112804-20120111
http://docs.fortinet.com/