FortiGate IPSec VPN User Guide - FirewallShop.com

Internet-browsing configuration
Routing all remote traffic through the VPN tunnel
Inbound NAT
Enable
Configure other settings as needed.
To create an Internet browsing policy - route-based VPN
1 Go to Firewall > Policy.
2 Select Create New, enter the following information and then select OK:
Source Interface
Source Address Name
Destination Interface
Destination Address Name
Schedule
Service
Action
NAT
Protection Profile
The IPSec VPN interface.
All
The interface that connects to the Internet. The virtual
IPSec interface is configured on this physical interface.
All
As required.
As required.
ACCEPT
Enable
Configure other settings as needed.
Select the protection profile that you want to apply to
Internet access.
The VPN clients must be configured to route all Internet traffic through the VPN
tunnel.
Routing all remote traffic through the VPN tunnel
To make use of the Internet browsing configuration on the VPN server, the VPN
peer or client must route all traffic through the VPN tunnel. Usually, only the traffic
destined for the private network behind the FortiGate VPN server is sent through
the tunnel.
The remote end of the VPN can be a FortiGate unit that acts as a peer in a
gateway-to-gateway configuration or a FortiClient Host Security application that
protects an individual client such as a notebook PC.
• To configure a remote peer FortiGate unit for Internet browsing via VPN, see
“Configuring a FortiGate remote peer to support Internet browsing”.
• To configure a FortiClient Host Security application for Internet browsing via
VPN, see “Configuring a FortiClient application to support Internet browsing”
on page 82.
These procedures assume that your VPN connection to the protected private
network is working and that you have configured the FortiGate VPN server for
Internet browsing as described in “Creating an Internet browsing firewall policy”
on page 80.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 81