FortiGate IPSec VPN User Guide - FirewallShop.com

Defining the tunnel ends
Auto Key phase 1 parameters
Defining the tunnel ends
To begin defining the phase 1 configuration, you go to VPN > IPSEC > Auto Key
and select Create Phase 1. Enter a descriptive name for the VPN tunnel. This is
particularly important if you will create several tunnels.
The phase 1 configuration mainly defines the ends of the IPSec tunnel. The
remote end is the remote gateway with which the FortiGate unit exchanges IPSec
packets. The local end is FortiGate interface that sends and receives IPSec
packets.
The remote gateway can be any of the following:
• a static IP address
• a domain name with a dynamic IP address
• a dialup client
A statically addressed remote gateway is the simplest to configure. You specify
the IP address. Unless restricted in the firewall policy, either the remote peer or a
peer on the network behind the FortiGate unit can bring up the tunnel.
If the remote peer has a domain name and subscribes to a dynamic DNS service,
you need to specify only the domain name. The FortiGate unit performs a DNS
query to determine the appropriate IP address. Unless restricted in the firewall
policy, either the remote peer or a peer on the network behind the FortiGate unit
can bring up the tunnel.
If the remote peer is a dialup client, only the dialup client can bring up the tunnel.
The IP address of the client is not known until it connects to the FortiGate unit.
This configuration is a typical way to provide a VPN for client PCs running VPN
client software such as the FortiClient Host Security application.
The local end of the VPN tunnel, the Local Interface, is the FortiGate interface that
sends and receives the IPSec packets. This is usually the public interface of the
FortiGate unit that is connected to the Internet. Packets from this interface pass to
the private network through a firewall policy. If you are configuring an interface
mode VPN, in the Advanced phase 1 settings you can optionally specify a unique
address for the FortiGate end of the tunnel. By default, the FortiGate unit uses the
IP address of the selected Local Interface taken from the System > Network >
Interface settings.
Choosing main mode or aggressive mode
The FortiGate unit and the remote peer or dialup client exchange phase 1
parameter in either Main mode or Aggressive mode.
• In Main mode, the phase 1 parameters are exchanged in multiple rounds with
encrypted authentication information
• In Aggressive mode, the phase 1 parameters are exchanged in single
message with authentication information that is not encrypted.
Main mode is more secure, but you must select Aggressive mode if there is more
than one dialup phase 1 configuration for the interface IP address and the remote
VPN peer or client is authenticated using an identifier (local ID). Descriptions of
the peer options in this guide indicate if either Main or Aggressive mode is
required.
FortiGate IPSec VPN Version 3.0 User Guide
128 01-30005-0065-20070716