FortiGate IPSec VPN User Guide - FirewallShop.com

Authenticating the FortiGate unit
Auto Key phase 1 parameters
Peer Options
Advanced
Peer options define the authentication requirements for
remote peers or dialup clients, not for the FortiGate unit itself.
For more information, see “Authenticating remote peers and
clients” on page 131.
You can retain the default settings unless changes are
needed to meet your specific requirements. See “Defining
IKE negotiation parameters” on page 137.
4 If you are configuring authentication parameters for a dialup user group, optionally
define extended authentication (XAuth) parameters. See “Using the FortiGate unit
as an XAuth server” on page 141.
5 Select OK.
Authenticating the FortiGate unit with a pre-shared key
The simplest way to authenticate a FortiGate unit to its remote peers or dialup
clients is by means of a pre-shared key. This is less secure than using certificates,
especially if it used alone, without requiring peer IDs or extended authentication
(XAuth). Also, you need to have a secure way to distribute the pre-shared key to
the peers.
If you use pre-shared key authentication alone, all remote peers and dialup clients
must be configured with the same pre-shared key. Optionally, you can configure
remote peers and dialup clients with unique pre-shared keys. On the FortiGate
unit, these are configured in user accounts, not in the phase_1 settings. For more
information, see “Enabling VPN access using user accounts and pre-shared keys”
on page 135.
The pre-shared key must contain at least 6 printable characters and should be
known only to network administrators. For optimum protection against currently
known attacks, the key should consist of a minimum of 16 randomly chosen
alphanumeric characters.
If you authenticate the FortiGate unit using a pre-shared key, you can require
remote peers or dialup clients to authenticate using peer IDs, but not client
certificates.
To authenticate the FortiGate unit with a pre-shared key
1 Go to VPN > IPSEC > Auto Key.
2 Select Create Phase 1 to add a new phase 1 configuration or select the Edit
button beside an existing configuration.
3 Include appropriate entries as follows:
Name
Remote Gateway
Local Interface
Enter a name that reflects the origination of the remote
connection.
Select the nature of the remote connection:
• Static IP Address.
• Dialup User.
• Dynamic DNS.
For more information, see “Defining the tunnel ends” on
page 128.
Select the interface that is the local end of the IPSec tunnel.
For more information, see “Defining the tunnel ends” on
page 128.
FortiGate IPSec VPN Version 3.0 User Guide
130 01-30005-0065-20070716