Fortinet FortiGate 100 Installation & Configuration Manual page 200

VPN concentrator (hub) general configuration steps
200
To create a VPN concentrator configuration:
1 Configure a tunnel for each spoke. Choose between a manual key tunnel or an
AutoIKE tunnel.
• A manual key tunnel consists of a name for the tunnel, the IP address of the spoke
(client or gateway) at the opposite end of the tunnel, and the encryption and
authentication algorithms to use for the tunnel.
See "Manual key IPSec VPNs" on page
• An AutoIKE tunnel consists of phase 1 and phase 2 parameters. The phase 1
parameters include the name of the spoke (client or gateway), designation of how
the spoke receives its IP address (static or dialup), encryption and authentication
algorithms, and the authentication method—either pre-shared keys or PKI
certificates. The phase 2 parameters include the name of the tunnel, selection of
the spoke (client or gateway) configured in phase 1, encryption and authentication
algorithms, and a number of security parameters.
See "AutoIKE IPSec VPNs" on page
2 Add a destination addresses for each spoke. The destination address is the address
of the spoke (either a client on the Internet or a network located behind a gateway).
See "Adding a source address" on page
3 Add the concentrator configuration. This step groups the tunnels together on the
FortiGate unit. The tunnels link the hub to the spokes. The tunnels are added as part
of the AutoIKE phase 2 configuration or the manual key configuration.
See "Adding a VPN concentrator" on page
Note: Add the concentrator configuration to the central FortiGate unit (the hub) after adding the
tunnels for all spokes.
4 Add an encrypt policy for each spoke. Encrypt policies control the direction of traffic
through the hub and allow inbound and outbound VPN connections between the hub
and the spokes. The encrypt policy for each spoke must include the tunnel name of
the spoke. The source address must be Internal_All. Use the following configuration
for the encrypt policies:
Source Internal_All
Destination The VPN spoke address.
Action ENCRYPT
VPN Tunnel The VPN spoke tunnel name.
Allow inbound Select allow inbound.
Allow outbound Select allow outbound
Inbound NAT Select inbound NAT if required.
Outbound NAT Select outbound NAT if required.
See "Adding an encrypt policy" on page
5 Arrange the policies in the following order:
• encrypt policies
• default non-encrypt policy (Internal_All -> External_All)
183.
185.
197.
201.
197.
IPSec VPN
Fortinet Inc.