FortiGate IPSec VPN User Guide - FirewallShop.com

Defining firewall policies
Defining firewall policies
When used in conjunction with the natip CLI attribute (see the “config firewall”
chapter of the FortiGate CLI Reference), outbound NAT enables you to change
the source addresses of IP packets before they go into the tunnel. This feature is
often used to resolve ambiguous routing when two or more of the private networks
making up a VPN have the same or overlapping IP addresses. For examples of
how to use these two features together, see the FortiGate Outbound NAT for
IPSec VIP Technical Note and the FortiGate IPSec VPN Subnet-address
Translation Technical Note.
When inbound NAT is enabled, inbound encrypted packets are intercepted and
decrypted, and the source IP addresses of the decrypted packets are translated
into the IP address of the FortiGate interface to the local private network before
they are routed to the private network. If the computers on the local private
network can communicate only with devices on the local private network (that is,
the FortiGate interface to the private network is not the default gateway) and the
remote client (or remote private network) does not have an IP address in the
same network address space as the local private network, enable inbound NAT.
Most firewall policies control outbound IP traffic. An outbound policy usually has a
source address originating on the private network behind the local FortiGate unit,
and a destination address belonging to a dialup VPN client or a network behind
the remote VPN peer. The source address that you choose for the firewall policy
identifies from where outbound cleartext IP packets may originate, and also
defines the local IP address or addresses that a remote server or client will be
allowed to access through the VPN tunnel. The destination address that you
choose for the firewall policy identifies where IP packets must be forwarded after
they are decrypted at the far end of the tunnel, and determines the IP address or
addresses that the local network will be able to access at the far end of the tunnel.
You can fine-tune a policy for services such as HTTP, FTP, and POP3; enable
logging, traffic shaping, antivirus protection, web filtering, email filtering, file
transfer, and email services throughout the VPN; and optionally allow connections
according to a predefined schedule. For more information, see the “Firewall
Policy” chapter of the FortiGate Administration Guide.
Note: As an option, differentiated services can be enabled in the firewall policy through CLI
commands. For more information, see the “firewall” chapter of the FortiGate CLI Reference.
When a remote server or client attempts to connect to the private network behind
a FortiGate gateway, the firewall policy intercepts the connection attempt and
starts the VPN tunnel. The FortiGate unit uses the remote gateway specified in its
phase 1 tunnel configuration to reply to the remote peer. When the remote peer
receives a reply, it checks its own firewall policy, including the tunnel
configuration, to determine which communications are permitted. As long as one
or more services are allowed through the VPN tunnel, the two peers begin to
negotiate the tunnel.
Before you begin
Before you define the IPSec policy, you must:
• Define the IP source and destination addresses. See “Defining firewall
addresses” on page 149.
• Specify the phase 1 authentication parameters. See “Auto Key phase 1
parameters” on page 127.
• Specify the phase 2 parameters. See “Phase 2 parameters” on page 143.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 151