FortiGate Administration Guide - FirewallShop.com

VPN IPSEC
Overview of IPSec interface mode
VPN IPSEC
This section provides information about policy-based (tunnel-mode) and routebased
(interface mode) Internet Protocol Security (IPSec) VPN options available
through the web-based manager. FortiGate units implement the Encapsulated
Security Payload (ESP) protocol. The encrypted packets look like ordinary
packets that can be routed through any IP network. Internet Key Exchange (IKE)
is performed automatically based on pre-shared keys or X.509 digital certificates.
As an option, you can specify manual keys. Interface mode is supported in
NAT/Route mode only. It creates a virtual interface for the local end of a VPN
tunnel.
Note: For information about how to configure an IPSec VPN, see the FortiGate IPSec VPN
User Guide.
This section describes:
• Overview of IPSec interface mode
• Auto Key
• Manual Key
• Concentrator
• Monitor
Overview of IPSec interface mode
When you define a route-based (interface mode) IPSec tunnel, a virtual IPSec
interface is created automatically. This is a subinterface of the FortiGate local
interface you selected in the IPSec phase 1 parameters. The local interface can
be a physical, aggregate, VLAN, inter-VDOM link or wireless interface.
An IPSec virtual interface is considered to be up when it can establish a phase 1
connection with a VPN peer or client. However, the virtual IPSec interface cannot
be used to send traffic through a tunnel until it is bound to a phase 2 definition.
Virtual IPSec interface bindings are shown on the System > Network > Interface
page. The names of all tunnels bound to physical interfaces are displayed under
their associated physical interface names in the Name column. For more
information about the Interface page, see “Interface” on page 79.
Note: You can bind a virtual IPSec interface to a zone.
After an IPSec virtual interface has been bound to a tunnel, traffic can be routed to
the interface using specific metrics for both static routes and policy routes. In
addition, you can create a firewall policy having the virtual IPSec interface as the
source or destination interface.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 343