fortigate-ipsec-40-mr3

Hub-and-spoke configurations Dynamic spokes configuration example
To specify the IP address the aggregate protected subnet
1 Go to Firewall Objects > Address > Address.
2 Select Create New, enter the following information, and select OK:
Address Name Enter an address name (for example, Spoke_net).
Subnet/IP Range
To define the security policy for traffic from the hub to the spokes
1 Go to Policy > Policy > Policy.
2 Select Create New, enter the following information, and select OK:
3 Place the policy in the policy list above any other policies having similar source and
destination addresses.
Configure communication between spokes
Enter the IP address of the aggregate protected network,
10.1.0.0/16
Source Interface/Zone Select the interface to the HR network, port 1.
Address Name HR_Network
Destination
Select the virtual IPsec interface that connects to the
Interface/Zone
spokes, toSpokes
Address Name Spoke_net
Schedule As required.
Service As required.
Action ACCEPT
Spokes communicate with each other through the hub. You need to configure the hub to
allow this communication. An easy way to do this is to create a zone containing the virtual
IPsec interfaces even if there is only one, and create a zone-to-zone security policy.
To create a zone for the VPN
1 Go to System > Network > Interface.
2 Select the down-arrow on the Create New button and select Zone.
3 In the Zone Name field, enter a name, such as Our_VPN_zone.
4 Select Block intra-zone traffic.
You could enable intra-zone traffic and then you would not need to create a security
policy. But, you would not be able to apply UTM features.
5 In Interface Members, select the virtual IPsec interface, toSpokes.
6 Select OK.
To create a security policy for the zone
1 Go to Policy > Policy > Policy. Select Create New and enter these settings:
Source Interface/Zone Select Our_VPN_zone.
Source Address Name Select All.
Destination Interface/Zone Select Our_VPN_zone.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 97
http://docs.fortinet.com/