FortiGate IPSec VPN User Guide - FirewallShop.com

Authenticating remote peers and clients
Auto Key phase 1 parameters
• You can permit access to remote peers or dialup clients who each have a
unique peer ID and a unique preshared key. Each peer or client must have a
user account on the FortiGate unit. See “Enabling VPN access using user
accounts and pre-shared keys” on page 135.
For authentication of users of the remote peer or dialup client device, see “Using
XAuth authentication” on page 141.
Enabling VPN access for specific certificate holders
When a VPN peer or dialup client is configured to authenticate using digital
certificates, it sends the DN of its certificate to the FortiGate unit. This DN can be
used to allow VPN access for the certificate holder. That is, a FortiGate unit can
be configured to deny connections to all remote peers and dialup clients except
the one having the specified DN.
Before you begin
The following procedures assume that you already have an existing phase 1
configuration (see “Authenticating the FortiGate unit with digital certificates” on
page 129). Follow the procedures below to add certificate-based authentication
parameters to the existing configuration.
Before you begin, you must obtain the certificate DN of the remote peer or dialup
client. If you are using the FortiClient Host Security application as a dialup client,
refer to FortiClient online Help for information about how to view the certificate
DN. To view the certificate DN of a FortiGate unit, see “To view server certificate
information and obtain the local DN” on page 133.
Afterward, use the config user peer CLI command to load the DN value into the
FortiGate configuration. For example, if a remote VPN peer uses server
certificates issued by your own organization, you would enter information similar
to the following:
config user peer
edit DN_FG1000
set cn 192.168.2.160
set cn-type ipv4
end
The value that you specify to identify the entry (for example, DN_FG1000) is
displayed in the Accept this peer certificate only list in the IPSec phase 1
configuration when you return to the web-based manager.
If the remote VPN peer has a CA-issued certificate to support a higher level of
credibility, you would enter information similar to the following:
config user peer
edit CA_FG1000
set ca CA_Cert_1
set subject FG1000_at_site1
end
The value that you specify to identify the entry (for example, CA_FG1000) is
displayed in the Accept this peer certificate only list in the IPSec phase 1
configuration when you return to the web-based manager. For more information
about these CLI commands, see the “user” chapter of the FortiGate CLI
Reference.
FortiGate IPSec VPN Version 3.0 User Guide
132 01-30005-0065-20070716