FortiGate IPSec VPN User Guide - FirewallShop.com

Hub-and-spoke configurations
Dynamic spokes configuration example
Configure the hub (FortiGate_1)
The phase 1 configuration defines the parameters that FortiGate_1 will use to
authenticate spokes and establish secure connections.
For the purposes of this example, one preshared key will be used to authenticate
all of the spokes. Each key must contain at least 6 printable characters and should
only be known by network administrators. For optimum protection against
currently known attacks, each key should consist of a minimum of 16 randomly
chosen alphanumeric characters.
Define the IPsec configuration
To define the phase 1 parameters
1 At FortiGate_1, go to VPN > IPSEC > Auto Key.
2 Define the phase 1 parameters that the hub will use to establish a secure
connection to the spokes. Select Create Phase 1, enter the following information,
and select OK:
Name
Remote Gateway
Local Interface
Mode
Authentication Method
Pre-shared Key
Peer Options
Type a name (for example, toSpokes).
Dialup user
External
Main
Preshared Key
Enter the preshared key.
Accept any peer ID
The basic phase 2 settings associate IPSec phase 2 parameters with the phase 1
configuration and specify the remote end points of the VPN tunnels.
To define the phase 2 parameters
1 Go to VPN > IPSEC > Auto Key.
2 Create a phase 2 tunnel definition for the spokes. Select Create Phase 2, enter
the following information, and select OK:
Name
Phase 1
Enter a name for the phase 2 definition (for example,
toSpokes_ph2).
Select the Phase 1 configuration that you defined previously
(for example, toSpokes).
Define the firewall policies
Firewall policies control all IP traffic passing between a source address and a
destination address. For a route-based VPN, the policies are simpler than for a
policy-based VPN. Instead of an IPSEC policy, you use an ACCEPT policy with
the virtual IPSec interface as the external interface.
Before you define firewall policies, you must first define firewall addresses to use
in those policies. You need addresses for:
• the HR network behind FortiGate_1
• the aggregate subnet address for the protected networks
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 43