FortiGate Administration Guide - FirewallShop.com

VPN IPSEC
Auto Key
Auto Key
Two VPN peers (or a FortiGate dialup server and a VPN client) can be configured
to generate unique Internet Key Exchange (IKE) keys automatically during the
IPSec phase 1 and phase 2 exchanges.
To configure the FortiGate unit to generate unique keys automatically in phase 1
and phase 2, go to VPN > IPSEC > Auto Key (IKE).
When you define phase 2 parameters, you can choose any set of phase 1
parameters to set up a secure connection for the tunnel and authenticate the
remote peer.
Auto Key configuration applies to both tunnel-mode and interface-mode VPNs.
Figure 222:Auto Key list
Edit
Delete
Create Phase 1 Create a new phase 1 tunnel configuration. See “Creating a new
phase 1 configuration” on page 345.
Create Phase 2 Create a new phase 2 configuration. See “Creating a new phase 2
configuration” on page 350.
Phase 1
The names of existing phase 1 tunnel configurations.
Phase 2
The names of existing phase 2 configurations.
Interface Binding The names of the local interfaces to which IPSec tunnels are
bound. These can be physical, aggregate, VLAN, inter-VDOM link
or wireless interfaces.
Delete and Edit icons Delete or edit a phase 1 configuration.
Creating a new phase 1 configuration
In phase 1, two VPN peers (or a FortiGate dialup server and a VPN client)
authenticate each other and exchange keys to establish a secure communication
channel between them. The basic phase 1 settings associate IPSec phase 1
parameters with a remote gateway and determine:
• whether the various phase 1 parameters will be exchanged in multiple rounds
with encrypted authentication information (main mode) or in a single message
with authentication information that is not encrypted (aggressive mode)
• whether a pre-shared key or digital certificates will be used to authenticate the
identities of the two VPN peers (or a VPN server and its client)
• whether a special identifier, certificate distinguished name, or group name will
be used to identify the remote VPN peer or client when a connection attempt is
made
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 345