FortiGate IPSec VPN User Guide - FirewallShop.com

Configure the VPN peers
Gateway-to-gateway configurations
• Define an address name for the IP address and netmask of the private network
behind the remote peer.
4 Define firewall policies to permit communication between the private networks
through the VPN tunnel. Route-based and policy-based VPNs require different
firewall policies. For detailed information about creating firewall policies, see
“Defining firewall policies” on page 150.
Policy-based VPN firewall policy
Define an IPSec firewall policy to permit communications between the source and
destination addresses. Enter these settings in particular:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Action
VPN Tunnel
Select the interface that connects to the private network
behind this FortiGate unit.
Select the address name that you defined in Step 3 for the
private network behind this FortiGate unit.
Select the FortiGate unit’s public interface.
Select the address name that you defined in Step 3 for the
private network behind the remote peer.
Select IPSEC.
Select the name of the phase 1 configuration that you
created in Step 1.
Select Allow inbound to enable traffic from the remote
network to initiate the tunnel.
Select Allow outbound to enable traffic from the local
network to initiate the tunnel.
Route-based VPN firewall policies
Define an ACCEPT firewall policy to permit communications between the source
and destination addresses. Enter these settings in particular:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Action
NAT
Select the interface that connects to the private network
behind this FortiGate unit.
Select the address name that you defined in Step 3 for the
private network behind this FortiGate unit.
Select the VPN Tunnel (IPSec Interface) you configured in
Step 1.
Select the address name that you defined in Step 3 for the
private network behind the remote peer.
Select ACCEPT.
Disable.
To permit the remote client to initiate communication, you need to define a firewall
policy for communication in that direction. Enter these settings in particular:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Action
NAT
Select the VPN Tunnel (IPSec Interface) you configured in
Step 1.
Select the address name that you defined in Step 3 for the
private network behind the remote peer.
Select the interface that connects to the private network
behind this FortiGate unit.
Select the address name that you defined in Step 3 for the
private network behind this FortiGate unit.
Select ACCEPT.
Disable.
FortiGate IPSec VPN Version 3.0 User Guide
22 01-30005-0065-20070716