FortiGate Administration Guide - FirewallShop.com

Auto Key
VPN IPSEC
Accept this
peer certificate
only
Accept this
peer certificate
group only
Defining phase 1 advanced settings
The advanced P1 Proposal parameters select the encryption and authentication
algorithms that the FortiGate unit uses to generate keys for the IKE exchange.
Additional advanced phase 1 settings can be selected to ensure the smooth
operation of phase 1 negotiations.
To modify IPSec phase 1 advanced parameters, go to VPN > IPSEC >
Auto Key (IKE), select Create Phase 1, and then select Advanced. For
information about how to choose the correct advanced phase 1 settings for your
particular situation, see the FortiGate IPSec VPN User Guide.
Figure 224:Phase 1 advanced settings
Authenticate remote peers or dialup clients using a security
certificate. Select the certificate from the list adjacent to the option.
You must add peer certificates to the FortiGate configuration through
the User > PKI page before you can select them here. For more
information, see “PKI authentication” on page 384.
This option is available when Authentication Method is set to RSA
Signature.
Use a certificate group to authenticate dialup clients that have
dynamic IP addresses and use unique certificates.
Select the name of the peer group from the list. You must first create
the group through the config user peergrp CLI command
before you can select it. For more information, see the “user” chapter
of the FortiGate CLI Reference. Members of the peer group must be
certificates added through the User > PKI page or the config
user peer CLI command.
This option is available when Authentication Method is set to RSA
Signature and Remote Gateway is set to Dialup User.
Advanced Define advanced phase 1 parameters. See “Defining phase 1
advanced settings” on page 348.
Add
FortiGate Version 3.0 MR5 Administration Guide
348 01-30005-0203-20070830