FortiGate IPSec VPN User Guide - FirewallShop.com
FortiGate IPSec VPN User Guide - FirewallShop.com
FortiGate IPSec VPN User Guide - FirewallShop.com
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Hub-and-spoke configurations<br />
Configuration overview<br />
Hub-and-spoke configurations<br />
This section describes how to set up hub-and-spoke <strong>IPSec</strong> <strong>VPN</strong>s. The following<br />
topics are included in this section:<br />
• Configuration overview<br />
• Configure the hub<br />
• Configure the spokes<br />
• Dynamic spokes configuration example<br />
Configuration overview<br />
In a hub-and-spoke configuration, <strong>VPN</strong> connections radiate from a central<br />
<strong>FortiGate</strong> unit (the hub) to a number of remote peers (the spokes). Traffic can<br />
pass between private networks behind the hub and private networks behind the<br />
remote peers. Traffic can also pass between remote peer private networks<br />
through the hub.<br />
Figure 6:<br />
Example hub-and-spoke configuration<br />
Site_1<br />
Site_2<br />
Internet<br />
Spoke_1<br />
Spoke_2<br />
Hub<br />
Subnet_1 (192.168.2.0/24)<br />
Finance Network<br />
HR Network<br />
The actual implementation varies in <strong>com</strong>plexity depending on<br />
• whether the spokes are statically or dynamically addressed<br />
• the addressing scheme of the protected subnets<br />
• how peers are authenticated<br />
This guide discusses the issues involved in configuring a hub-and-spoke <strong>VPN</strong> and<br />
provides some basic configuration examples.<br />
<strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong> Version 3.0 <strong>User</strong> <strong>Guide</strong><br />
01-30005-0065-20070716 33
Change language