FortiGate IPSec VPN User Guide - FirewallShop.com

FortiGate dialup-client configurations
Configure the FortiGate dialup client
Local ID
Enable IPSec
Interface Mode
If you defined a peer ID for the dialup client in the FortiGate dialup
server configuration, enter the identifier of the dialup client. The
value must be identical to the peer ID that you specified previously
in the FortiGate dialup server configuration.
If IPSec Interface Mode is enabled, the FortiGate unit creates a
virtual IPSec interface for a route-based VPN. Disable this option
if you want to create a policy-based VPN.
After you select OK to create the phase 1 configuration, you
cannot change this setting.
2 Define the phase 2 parameters needed to create a VPN tunnel with the dialup
server. See “Phase 2 parameters” on page 143. Enter these settings in particular:
Name
Enter a name to identify this phase 2 configuration.
Phase 1 Select the set of phase 1 parameters that you defined in step 1.
3 Define names for the addresses or address ranges of the private networks that
the VPN links. See “Defining firewall addresses” on page 149. Enter these
settings in particular:
• Define an address name for the server, host, or network behind the FortiGate
dialup server.
• Define an address name for the private network behind the FortiGate dialup
client.
4 Define firewall policies to permit communication between the private networks
through the VPN tunnel. Route-based and policy-based VPNs require different
firewall policies. For detailed information about creating firewall policies, see
“Defining firewall policies” on page 150.
Policy-based VPN firewall policy
Define an IPSec firewall policy to permit communications between the source and
destination addresses. Enter these settings in particular:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Action
VPN Tunnel
Select the interface that connects to the private network
behind this FortiGate unit.
Select the address name that you defined in Step 3 for the
private network behind this FortiGate unit.
Select the FortiGate unit’s public interface.
Select the address name that you defined in Step 3 for the
private network behind the dialup server.
Select IPSEC.
Select the name of the phase 1 configuration that you
created in Step 1.
Clear Allow inbound to prevent traffic from the remote
network from initiating the tunnel after the tunnel has been
established.
Select Allow outbound to enable traffic from the local
network to initiate the tunnel.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 77