FortiGate IPSec VPN User Guide - FirewallShop.com

Configure the dynamically-addressed VPN peer
Dynamic DNS configurations
Action
VPN Tunnel
Select IPSEC.
Select the name of the phase 1 configuration that you
created in Step 1.
Select Allow inbound to enable traffic from the remote
network to initiate the tunnel.
Select Allow outbound to enable traffic from the local
network to initiate the tunnel.
Route-based VPN firewall policies
Define ACCEPT firewall policies to permit communication between the private
networks. To define a policy to permit the local FortiGate unit to initiate
communication, enter these settings in particular:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Action
NAT
Select the interface that connects to the private network
behind this FortiGate unit.
Select the address name that you defined in Step 3 for the
private network behind this FortiGate unit.
Select the VPN Tunnel (IPSec Interface) you configured in
Step 1.
Select the address name that you defined in Step 3 for the
private network behind the remote peer.
Select ACCEPT.
Disable.
To permit the remote peer to initiate communication, you need to define a firewall
policy for communication in that direction. Enter these settings in particular:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Action
NAT
Select the VPN Tunnel (IPSec Interface) you configured in
Step 1.
Select the address name that you defined in Step 3 for the
private network behind the remote peer.
Select the interface that connects to the private network
behind this FortiGate unit.
Select the address name that you defined in Step 3 for the
private network behind this FortiGate unit.
Select ACCEPT.
Disable.
5 Place these policies in the policy list above any other policies having similar
source and destination addresses.
FortiGate IPSec VPN Version 3.0 User Guide
52 01-30005-0065-20070716