Table of Contents
Advertisement
IPSec VPN concentrators
VPN spoke general configuration steps
174
A remote VPN peer that is functioning as a spoke requires the following configuration:
•
A tunnel (AutoIKE phase 1 and phase 2 configuration or manual key configuration)
for the hub.
•
The source address of the local VPN spoke.
•
The destination address of each remote VPN spoke.
•
A separate outbound encrypt policy for each remote VPN spoke. These policies
allow the local VPN spoke to initiate encrypted connections.
•
A single inbound encrypt policy. This policy allows the local VPN spoke to accept
encrypted connections.
To create a VPN spoke configuration:
1
Configure a tunnel between the spoke and the hub.
Choose between a manual key tunnel or an AutoIKE tunnel.
•
To add a manual key tunnel, see
•
To add an AutoIKE tunnel, see:
2
Add the source address. One source address is required for the local VPN spoke.
See
"Adding a source address" on page
3
Add a destination addresses for each remote VPN spoke. The destination address is
the address of the spoke (either a client on the Internet or a network located behind a
gateway).
See
"Adding a destination address" on page 169
4
Add a separate outbound encrypt policy for each remote VPN spoke. These policies
control the encrypted connections initiated by the local VPN spoke.
The encrypt policy must include the appropriate source and destination addresses
and the tunnel added in step 1. Use the following configuration:
Source
The local VPN spoke address.
Destination
The remote VPN spoke address.
Action
ENCRYPT
VPN Tunnel
The VPN tunnel name added in step 1. (Use the same tunnel for all encrypt
policies.)
Allow inbound
Do not enable.
Allow outbound Select allow outbound
Inbound NAT
Select inbound NAT if required.
Outbound NAT Select outbound NAT if required.
See
"Adding an encrypt policy" on page
5
Add an inbound encrypt policy. This policies controls the encrypted connections
initiated by the remote VPN spokes.
The encrypt policy for the hub must include the appropriate source and destination
addresses and the tunnel added in step 1. Use the following configuration:
Source
The local VPN spoke address.
Destination
External_All
"Manual key IPSec VPNs" on page
"AutoIKE IPSec VPNs" on page
169.
169.
IPSec VPN
155.
157.
Fortinet Inc.
Advertisement
Table of Contents
