fortigate-ipsec-40-mr3

Dynamic spokes configuration example Hub-and-spoke configurations
Define the IPsec configuration
To define the phase 1 parameters
1 At FortiGate_1, go to VPN > IPsec > Auto Key (IKE).
2 Define the phase 1 parameters that the hub will use to establish a secure connection
to the spokes. Select Create Phase 1, enter the following information, and select OK:
Name Type a name (for example, toSpokes).
Remote Gateway Dialup user
Local Interface External
Mode Main
Authentication Method Preshared Key
Pre-shared Key Enter the preshared key.
Peer Options Accept any peer ID
The basic phase 2 settings associate IPsec phase 2 parameters with the phase 1
configuration and specify the remote end points of the VPN tunnels.
To define the phase 2 parameters
1 Go to VPN > IPsec > Auto Key (IKE).
2 Create a phase 2 tunnel definition for the spokes. Select Create Phase 2, enter the
following information, and select OK:
Name Enter a name for the phase 2 definition (for example, toSpokes_ph2).
Phase 1
Define the security policies
Select the Phase 1 configuration that you defined previously (for
example, toSpokes).
security policies control all IP traffic passing between a source address and a destination
address. For a route-based VPN, the policies are simpler than for a policy-based VPN.
Instead of an IPSEC policy, you use an ACCEPT policy with the virtual IPsec interface as
the external interface.
Before you define security policies, you must first define firewall addresses to use in
those policies. You need addresses for:
the HR network behind FortiGate_1
the aggregate subnet address for the protected networks
To define the IP address of the HR network behind FortiGate_1
1 Go to Firewall Objects > Address > Address.
2 Select Create New, enter the following information, and select OK:
Address Name Enter an address name (for example, HR_Network).
Subnet/IP Range
Enter the IP address of the HR network behind FortiGate_1
(for example, 10.1.0.0/24).
IPsec VPNs for FortiOS 4.0 MR3
96 01-434-112804-20120111
http://docs.fortinet.com/