FortiGate IPSec VPN User Guide - FirewallShop.com

Auto Key phase 1 parameters
Authenticating remote peers and clients
Mode
Authentication Method
Pre-shared Key
Peer options
Advanced
Select Main or Aggressive mode.
• In Main mode, the phase 1 parameters are exchanged in
multiple rounds with encrypted authentication
information.
• In Aggressive mode, the phase 1 parameters are
exchanged in single message with authentication
information that is not encrypted.
When the remote VPN peer or client has a dynamic IP
address, or the remote VPN peer or client will be
authenticated using an identifier (local ID), you must select
Aggressive mode if there is more than one dialup phase 1
configuration for the interface IP address.
For more information, see “Choosing main mode or
aggressive mode” on page 128.
Select Pre-shared Key.
Enter the preshared key that the FortiGate unit will use to
authenticate itself to the remote peer or dialup client during
phase 1 negotiations. You must define the same value at the
remote peer or client. The key must contain at least 6
printable characters and should only be known by network
administrators. For optimum protection against currently
known attacks, the key should consist of a minimum of 16
randomly chosen alphanumeric characters.
Peer options define the authentication requirements for
remote peers or dialup clients, not for the FortiGate unit itself.
You can require the use of peer IDs, but not client
certificates. For more information, see “Authenticating
remote peers and clients” on page 131.
You can retain the default settings unless changes are
needed to meet your specific requirements. See “Defining
IKE negotiation parameters” on page 137.
4 If you are configuring authentication parameters for a dialup user group, optionally
define extended authentication (XAuth) parameters. See “Using the FortiGate unit
as an XAuth server” on page 141.
5 Select OK.
Authenticating remote peers and clients
Certificates or pre-shared keys restrict who can access the VPN tunnel, but they
do not identify or authenticate the remote peers or dialup clients. You have the
following options for authentication:
• You can permit access only for remote peers or clients who use certificates
that you recognize. This is available only if the FortiGate unit authenticates
using certificates. See “Enabling VPN access for specific certificate holders”
on page 132.
• You can permit access only for remote peers or clients that have certain peer
identifier (local ID) value configured. This is available with both certificate and
preshared key authentication. See “Enabling VPN access by peer identifier” on
page 134.
• You can permit access to remote peers or dialup clients who each have a
unique preshared key. Each peer or client must have a user account on the
FortiGate unit. See “Enabling VPN access using user accounts and pre-shared
keys” on page 135.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 131