FortiGate IPSec VPN User Guide - FirewallShop.com

More documents

Recommendations

Info

Configure the hub Hub-and-spoke configurations Configuring communication between spokes (route-based VPN) For a route-based hub-and-spoke VPN, there are several ways you can enable communication between the spokes: • put all of the IPSec interfaces into a zone and enable intra-zone traffic. This eliminates the need for any firewall policy for the VPN, but you cannot apply a protection profile to scan the traffic for security threats. • put all of the IPSec interfaces into a zone and create a single zone-to-zone firewall policy • create a firewall policy for each pair of spokes that are allowed to communicate with each other. The number of policies required increases rapidly as the number of spokes increases. Using a zone as a concentrator A simple way to provide communication among all of the spokes is to create a zone and allow intra-zone communication. You cannot apply a protection profile using this method. 1 Go to System > Network > Zone. 2 In the Zone Name field, enter a name, such as Our_VPN_zone. 3 Clear Block intra-zone traffic. 4 In the Interface Members list, select the IPSec interfaces that are part of your VPN. 5 Select OK. Using a zone with a policy as a concentrator If you put all of the hub IPSec interfaces involved in the VPN into a zone, you can enable communication among all of the spokes and apply a protection profile with just one firewall policy. To create a zone for the VPN 1 Go to System > Network > Zone. 2 In the Zone Name field, enter a name, such as Our_VPN_zone. 3 Select Block intra-zone traffic. 4 In the Interface Members list, select the IPSec interfaces that are part of your VPN. 5 Select OK. To create a firewall policy for the zone 1 Go to Firewall > Policy. Select Create New and enter these settings: Source Interface/Zone Select the zone you created for your VPN. Source Address Name Select All. Destination Interface/Zone Select the zone you created for your VPN. Destination Address Name Select All. Action Select ACCEPT. FortiGate IPSec VPN Version 3.0 User Guide 38 01-30005-0065-20070716
Hub-and-spoke configurations Configure the hub NAT Protection profile Enable. If you want to apply a protection profile to this traffic, select the appropriate profile. 2 Select OK. Using firewall policies as a concentrator To enable communication between two spokes, you need to define an ACCEPT firewall policy for them. To allow either spoke to initiate communication, you must create a policy for each direction. This procedure describes a firewall policy for communication from Spoke 1 to Spoke 2. Others are similar. 1 Define names for the addresses or address ranges of the private networks behind each spoke. For more information, see “Defining firewall addresses” on page 149. 2 Go to Firewall > Policy. Select Create New and enter these settings in particular: Source Interface/Zone Select the IPSec interface that connects to Spoke 1. Source Address Name Select the address of the private network behind Spoke 1. Destination Interface/Zone Select the IPSec interface that connects to Spoke 2. Destination Address Name Select the address of the private network behind Spoke 2. Action Select ACCEPT. NAT Enable. Protection profile If you want to apply a protection profile to this traffic, select the appropriate profile. 3 Select OK. FortiGate IPSec VPN Version 3.0 User Guide 01-30005-0065-20070716 39
Page 1 and 2: USER GUIDE FortiGate IPSec VPN Vers
Page 3 and 4: Contents Contents Introduction ....
Page 5 and 6: Contents Adding XAuth authenticatio
Page 7 and 8: Contents Defining IKE negotiation p
Page 9 and 10: Introduction About FortiGate IPSec
Page 11 and 12: Introduction About this document
Page 13 and 14: Introduction Fortinet documentation
Page 15 and 16: Configuring IPSec VPNs IPSec VPN ov
Page 17 and 18: Configuring IPSec VPNs General prep
Page 19 and 20: Gateway-to-gateway configurations C
Page 21 and 22: Gateway-to-gateway configurations G
Page 29 and 30: Gateway-to-gateway configurations H
Page 31 and 32: Gateway-to-gateway configurations H
Page 33 and 34: Hub-and-spoke configurations Config
Page 37: Hub-and-spoke configurations Config
Page 43 and 44: Hub-and-spoke configurations Dynami
Page 49 and 50: Dynamic DNS configurations Configur
Page 55 and 56: FortiClient dialup-client configura
Page 71 and 72: FortiGate dialup-client configurati
Page 79 and 80: Internet-browsing configuration Con
Page 81 and 82: Internet-browsing configuration Rou
Page 83 and 84: Redundant VPN configurations Config
Page 85 and 86: Redundant VPN configurations Config
Page 87 and 88: Redundant VPN configurations Redund
Page 89 and 90:
Redundant VPN configurations Redund
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Redundant VPN configurations Partia
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Transparent mode VPNs Configuration
Page 107 and 108:
Transparent mode VPNs Configuration
Page 109 and 110:
Transparent mode VPNs Configure the
Page 111 and 112:
Manual-key configurations Configura
Page 113 and 114:
Manual-key configurations Specify t
Page 115 and 116:
IPv6 IPSec VPNs Overview of IPv6 IP
Page 117 and 118:
IPv6 IPSec VPNs Site-to-site IPv6 o
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Auto Key phase 1 parameters Overvie
Page 129 and 130:
Auto Key phase 1 parameters Authent
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Auto Key phase 1 parameters Definin
Page 139 and 140:
Auto Key phase 1 parameters Definin
Page 141 and 142:
Auto Key phase 1 parameters Using X
Page 143 and 144:
Phase 2 parameters Basic phase 2 se
Page 145:
Phase 2 parameters Advanced phase 2
Page 148 and 149:
Configure the phase 2 parameters Ph
Page 150 and 151:
Defining firewall policies Defining
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Monitoring VPN connections Monitori
Page 158 and 159:
Logging VPN events Monitoring and t
Page 160 and 161:
VPN troubleshooting tips Monitoring
Page 162 and 163:
Index Encryption Algorithm, Manual
Page 164 and 165:
Index remote peer authenticating wi
Page 166:
www.fortinet.com
show all

FortiGate IPSec VPN User Guide - FirewallShop.com

Create successful ePaper yourself

Delete template?

Save as template?