FortiGate IPSec VPN User Guide - FirewallShop.com
FortiGate IPSec VPN User Guide - FirewallShop.com
FortiGate IPSec VPN User Guide - FirewallShop.com
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Configuration overview<br />
Hub-and-spoke configurations<br />
Hub-and-spoke infrastructure requirements<br />
Spoke gateway addressing<br />
• The <strong>FortiGate</strong> hub must be operating in NAT/Route mode and have a static<br />
public IP address.<br />
• Spokes may have static IP addresses, dynamic IP addresses (see “<strong>FortiGate</strong><br />
dialup-client configurations” on page 71), or static domain names and dynamic<br />
IP addresses (see “Dynamic DNS configurations” on page 49).<br />
The public IP address of the spoke is the <strong>VPN</strong> remote gateway as seen from the<br />
hub. Statically addressed spokes each require a separate <strong>VPN</strong> phase 1<br />
configuration on the hub. When there are many spokes, this be<strong>com</strong>es rather<br />
cumbersome.<br />
Using dynamic addressing for spokes simplifies the <strong>VPN</strong> configuration because<br />
then the hub requires only a single phase 1 configuration with “dialup user” as the<br />
remote gateway. You can use this configuration even if the remote peers have<br />
static IP addresses. A remote peer can establish a <strong>VPN</strong> connection regardless of<br />
its IP address if its traffic selectors match and it can authenticate to the hub. See<br />
“Dynamic spokes configuration example” on page 42 for an example of this<br />
configuration.<br />
Protected networks addressing<br />
The addresses of the protected networks are needed to configure destination<br />
selectors and sometimes for firewall policies and static routes. The larger the<br />
number of spokes, the more addresses there are to manage. You can<br />
• assign spoke subnets as part of a larger subnet, usually on a new network<br />
or<br />
• create address groups that contain all of the needed addresses<br />
Using aggregated subnets<br />
If you are creating a new network, where subnet IP addresses are not already<br />
assigned, you can simplify the <strong>VPN</strong> configuration by assigning spoke subnets that<br />
are part of a large subnet.<br />
Figure 7:<br />
Aggregated subnets<br />
large subnet<br />
hub protected subnet: 10.1.0.0/24<br />
spoke 1 protected subnet: 10.1.1.0/24<br />
spoke 2 protected subnet: 10.1.2.0/24<br />
spoke x protected subnet: 10.1.x.0/24<br />
All spokes use the large subnet address, 10.1.0.0/16 for example, as<br />
• the IPsec destination selector<br />
• the destination of the firewall policy from the private subnet to the <strong>VPN</strong><br />
(required for policy-based <strong>VPN</strong>, optional for interface-based <strong>VPN</strong>)<br />
• the destination of the static route to the <strong>VPN</strong> (interface-based)<br />
<strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong> Version 3.0 <strong>User</strong> <strong>Guide</strong><br />
34 01-30005-0065-20070716
Change language