FortiGate IPSec VPN User Guide - FirewallShop.com

Dynamic spokes configuration example
Hub-and-spoke configurations
To define the phase 2 parameters
1 Go to VPN > IPSEC > Auto Key.
2 Select Create Phase 2, enter the following information, and select OK:
Name
Phase 1
Advanced
Source
Enter a name for the tunnel (for example, toHub_ph2).
Select the name of the phase 1 configuration that you defined
previously, for example, toHub.
Select to show the following Quick Mode Selector settings.
Enter the address of the protected network at this spoke.
For spoke_1, this is 10.1.1.0/24.
For spoke_2, this is 10.1.2.0/24.
Destination Enter the aggregate protected subnet address, 10.1.0.0/16.
Define the firewall policies
You need to define firewall addresses for the spokes and the aggregate protected
network and then create a firewall policy to enable communication between them.
To define the IP address of the network behind the spoke
1 Go to Firewall > Address.
2 Select Create New, enter the following information, and select OK:
Address Name
Subnet/IP Range
Enter an address name (for example, LocalNet).
Enter the IP address of the private network behind the
spoke.
For spoke_1, this is 10.1.1.0/24.
For spoke_2, this is 10.1.2.0/24.
To specify the IP address of the aggregate protected network
1 Go to Firewall > Address.
2 Select Create New, enter the following information, and select OK:
Address Name
Subnet/IP Range
Enter an address name (for example, Spoke_net).
Enter the IP address of the aggregate protected
network, 10.1.0.0/16).
To define the firewall policy
1 Go to Firewall > Policy.
2 Select Create New, enter the following information, and select OK:
Source
Destination
Schedule
Interface/Zone
Select the virtual IPSec interface, toHub.
Address Name
Select the aggregate protected network address
Spoke_net
Interface/Zone
Select the interface to the internal (private) network,
port1.
Address Name
Select the address for this spoke’s protected network
LocalNet
As required.
FortiGate IPSec VPN Version 3.0 User Guide
46 01-30005-0065-20070716