FortiGate IPSec VPN User Guide - FirewallShop.com

Auto Key phase 1 parameters
Authenticating the FortiGate unit
Authenticating the FortiGate unit
The FortiGate unit can authenticate itself to remote peers or dialup clients using
either a pre-shared key or an RSA Signature (certificate).
Authenticating the FortiGate unit with digital certificates
To authenticate the FortiGate unit using digital certificates, you must have the
required certificates installed on the remote peer and on the FortiGate unit. The
signed server certificate on one peer is validated by the presence of the root
certificate installed on the other peer. If you use certificates to authenticate the
FortiGate unit, you can also require the remote peers or dialup clients to
authenticate using certificates.
For more information about obtaining and installing certificates, see the FortiGate
Certificate Management User Guide.
To authenticate the FortiGate unit using digital certificates
1 Go to VPN > IPSEC > Auto Key.
2 Select Create Phase 1 to add a new phase 1 configuration or select the Edit
button beside an existing Phase 1 configuration.
3 Include appropriate entries as follows:
Name
Remote Gateway
Local Interface
Mode
Authentication Method
Certificate Name
Enter a name that reflects the origination of the remote
connection.
Select the nature of the remote connection:
• Static IP Address.
• Dialup User.
• Dynamic DNS.
For more information, see “Defining the tunnel ends” on
page 128.
Select the interface that is the local end of the IPSec tunnel.
For more information, see “Defining the tunnel ends” on
page 128.
Select Main or Aggressive mode.
• In Main mode, the phase 1 parameters are exchanged in
multiple rounds with encrypted authentication information.
• In Aggressive mode, the phase 1 parameters are
exchanged in single message with authentication
information that is not encrypted.
When the remote VPN peer or client has a dynamic IP
address, or the remote VPN peer or client will be
authenticated using an identifier (local ID), you must select
Aggressive mode if there is more than one dialup phase 1
configuration for the interface IP address.
For more information, see “Choosing main mode or
aggressive mode” on page 128.
Select RSA Signature.
Select the name of the server certificate that the FortiGate
unit will use to authenticate itself to the remote peer or dialup
client during phase 1 negotiations. To obtain and load the
required server certificate, see the FortiGate Certificate
Management User Guide.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 129