FortiGate IPSec VPN User Guide - FirewallShop.com

Hub-and-spoke configurations
Dynamic spokes configuration example
5 Select OK.
To create a firewall policy for the zone
1 Go to Firewall > Policy. Select Create New and enter these settings:
2 Select OK.
Configure the spokes
Source Interface/Zone Select Our_VPN_zone.
Source Address Name Select All.
Destination Interface/Zone Select Our_VPN_zone.
Destination Address Name Select All.
Action
Select ACCEPT.
NAT
Enable.
Protection profile
Select the appropriate protection profile.
In this example, all spokes have nearly identical configuration, requiring the
following:
• phase 1 authentication parameters to initiate a connection with the hub
• phase 2 tunnel creation parameters to establish a VPN tunnel with the hub
• a source address that represents the network behind the spoke. This is the
only part of the configuration that is different for each spoke.
• a destination address that represents the aggregate protected network
• a firewall policy to enable communications between the spoke and the
aggregate protected network
Define the IPsec configuration
At each spoke, create the following configuration.
To define the phase 1 parameters
1 At the spoke, go to VPN > IPSEC > Auto Key.
2 Select Create Phase 1, enter the following information, and select OK:
Name
Type a name, for example, toHub).
Remote Gateway Static IP Address
IP Address 172.16.10.1
Local Interface
Port2
Mode
Main
Authentication Method Preshared Key
Pre-shared Key
Enter the preshared key. The value must be identical to
the preshared key that you specified previously in the
FortiGate_1 configuration.
Peer Options
Accept any peer ID
Enable IPSec Interface
Mode
Select Advanced to see this option. Enable the option
to create a route-based VPN.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 45