fortigate-ipsec-40-mr3

Dynamic spokes configuration example Hub-and-spoke configurations
2 Select OK.
Configure the spokes
Destination Address Name Select All.
Action Select ACCEPT.
NAT Enable.
UTM Select the appropriate UTM profiles.
In this example, all spokes have nearly identical configuration, requiring the following:
phase 1 authentication parameters to initiate a connection with the hub
phase 2 tunnel creation parameters to establish a VPN tunnel with the hub
a source address that represents the network behind the spoke. This is the only part
of the configuration that is different for each spoke.
a destination address that represents the aggregate protected network
a security policy to enable communications between the spoke and the aggregate
protected network
Define the IPsec configuration
At each spoke, create the following configuration.
To define the Phase 1 parameters
1 At the spoke, go to VPN > IPsec > Auto Key (IKE).
2 Select Create Phase 1, enter the following information, and select OK:
Name Type a name, for example, toHub.
Remote Gateway Static IP Address
IP Address 172.16.10.1
Local Interface Port2
Mode Main
Authentication Method Preshared Key
Enter the preshared key. The value must be identical to the
Pre-shared Key preshared key that you specified previously in the
FortiGate_1 configuration.
Peer Options Accept any peer ID
Enable IPsec Interface
Mode
Select Advanced to see this option. Enable the option to
create a route-based VPN.
To define the Phase 2 parameters
1 Go to VPN > IPsec > Auto Key (IKE).
2 Select Create Phase 2, enter the following information, and select OK:
Name Enter a name for the tunnel, for example, toHub_ph2.
Phase 1
Select the name of the phase 1 configuration that you defined
previously, for example, toHub.
Advanced Select to show the following Quick Mode Selector settings.
IPsec VPNs for FortiOS 4.0 MR3
98 01-434-112804-20120111
http://docs.fortinet.com/