FortiGate Administration Guide - FirewallShop.com

VPN IPSEC
Auto Key
Quick Mode
Selector
Optionally specify the source and destination IP addresses to be used as
selectors for IKE negotiations. If the FortiGate unit is a dialup server, the
default value 0.0.0.0/0 should be kept unless you need to circumvent
problems caused by ambiguous IP addresses between one or more of
the private networks making up the VPN. You can specify a single host IP
address, an IP address range, or a network address. You may optionally
specify source and destination port numbers and/or a protocol number.
If you are editing an existing phase 2 configuration, the Source address
and Destination address fields are unavailable if the tunnel has been
configured to use firewall addresses as selectors. This option exists only
in the CLI. See the dst-addr-type, dst-name, src-addr-type and
src-name keywords for the vpn ipsec phase2 command in the
FortiGate CLI Reference.
Source address
Source port
Destination
address
Destination port
Protocol
If the FortiGate unit is a dialup server, type the
source IP address that corresponds to the local
sender(s) or network behind the local VPN peer (for
example, 172.16.5.0/24 or
172.16.5.0/255.255.255.0 for a subnet, or
172.16.5.1/32 or
172.16.5.1/255.255.255.255 for a server or
host, or 192.168.10.[80-100] or
192.168.10.80-192.168.10.100 for an
address range). A value of 0.0.0.0/0 means all IP
addresses behind the local VPN peer.
If the FortiGate unit is a dialup client, source address
must refer to the private network behind the
FortiGate dialup client.
Type the port number that the local VPN peer uses to
transport traffic related to the specified service
(protocol number). The range is 0 to 65535. To
specify all ports, type 0.
Type the destination IP address that corresponds to
the recipient(s) or network behind the remote VPN
peer (for example, 192.168.20.0/24 for a subnet,
or 172.16.5.1/32 for a server or host, or
192.168.10.[80-100] for an address range). A
value of 0.0.0.0/0 means all IP addresses behind
the remote VPN peer.
Type the port number that the remote VPN peer uses
to transport traffic related to the specified service
(protocol number). The range is 0 to 65535. To
specify all ports, type 0.
Type the IP protocol number of the service. The
range is 0 to 255. To specify all services, type 0.
Internet browsing configuration
You can enable VPN users to browse the Internet through the FortiGate unit. You do this
with firewall policies. The required policies are different for policy-based and route-based
VPNs. For more information about firewall policies, see “Configuring firewall
policies” on page 271.
Policy-based VPN Internet browsing configuration
Configure an additional firewall policy as follows:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Action
Select the FortiGate unit public interface.
Select All
Select the FortiGate unit public interface.
Select the remote network address name.
Select IPSEC.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 353