FortiGate IPSec VPN User Guide - FirewallShop.com

Dynamic spokes configuration example
Hub-and-spoke configurations
Action
NAT
Select ACCEPT
Enable
Source Interface/Zone Select the spoke’s interface to the internal (private) network.
Source Address Name Select this spoke’s address name.
Destination Interface/Zone Select the virtual IPSec interface you created.
Destination Address Name Select the spoke address group you defined in Step 1.
Action
NAT
Select ACCEPT
Enable
3 Place this policy or policies in the policy list above any other policies having similar
source and destination addresses.
Dynamic spokes configuration example
This example demonstrates how to set up a basic route-based hub-and-spoke
IPSec VPN that uses preshared keys to authenticate VPN peers.
Figure 8:
Example hub-and-spoke configuration
Spoke_1
Spoke_2
Internet
Site_1
10.1.1.0/24
Hub
172.16.10.1
FortiGate_1
Site_2
10.1.2.0/24
HR Network
10.1.0.0/24
In the example configuration, the protected networks 10.1.0.0/24, 10.1.1.0/24 and
10.1.2.0/24 are all part of the larger subnet 10.1.0.0/16. The steps for setting up
the example hub-and-spoke configuration create a VPN among Site 1, Site 2, and
the HR Network.
The spokes are dialup. Their addresses are not part of the configuration on the
hub, so only one spoke definition is required no matter the number of spokes. For
simplicity, only two spokes are shown.
FortiGate IPSec VPN Version 3.0 User Guide
42 01-30005-0065-20070716