Setting The Destination Address For Encrypted Traffic; Adding An Ipsec Firewall Encryption Policy; Internet Browsing Through A Vpn Tunnel - Fortinet FortiGate FortiGate-200A Administration Manual

VPN

Setting the destination address for encrypted traffic

Adding an IPSec firewall encryption policy

Internet browsing through a VPN tunnel

FortiGate-200A Administration Guide
The destination address determines which remote peers and clients will be allowed to
access the specified source address. In general:
• For a gateway-to-gateway VPN, the destination address is the static private
address space assigned to the network behind the remote peer.
• For a peer-to-peer VPN, the destination address is the static public IP address of
the remote peer.
• For remote-client configurations, the destination address is the IP address of the
remote client. If the remote client acquires a virtual IP address or a dynamic IP
address, the destination address that you specify must match the virtual or
dynamic IP address that the remote client can acquire.
To add a destination address, see
Use the following procedure to add an IPSec firewall encryption policy.
To define the firewall encryption policy
1 Go to Firewall > Address > Address.
2 Set the encryption policy direction. See
page 282.
3 Add the source and destination addresses. See
4 Set Action to ENCRYPT.
5 From the VPN tunnel list, select a phase 2 tunnel configuration.
6 Configure the following options if required:
7 Select additional options if required to apply a protection profile and/or other firewall
policy features.
8 Select OK.
Using Internet browsing through a VPN tunnel, remote VPN users can connect to a
network behind a FortiGate unit or browse the Internet using the same VPN tunnel.
Firewall policies can apply virus scanning, web filtering, and other FortiGate features
to remote VPN traffic that connects to the Internet. Applying virus scanning and other
FortiGate features to remote VPN user Internet connections enhances the security of
remote VPN user traffic and protects remote VPN users from viruses and other threats
on the Internet. Also, if all remote VPN Internet traffic is sent over the VPN, the remote
client does not send any unencrypted traffic to the Internet.
Internet browsing through a VPN tunnel is supported between VPN peers or for a
remote VPN client. Internet browsing through a VPN tunnel is available for static IP
VPNs, dynamic DNS VPNs, and dialup VPNs.
"To add an address" on page
01-28006-0072-20041105
Internet browsing through a VPN tunnel
"Setting the encryption policy direction" on
"To add an address" on page
202.
202.
283