Phase 2 - Fortinet FortiGate FortiGate-5001 Administration Manual

Phase 2

Phase 2
260
Keylife Type the amount of time (in seconds) that will be allowed to pass before the
IKE encryption key expires. When the key expires, a new key is generated
without interrupting service. The keylife can be from 120 to 172800 seconds.
Local ID If you are using peer IDs for authentication, enter the peer ID that the local
FortiGate unit will use to authenticate itself to remote VPN peers.
If you are using certificates for authentication, select the distinguished name
(DN) of the local certificate.
XAuth If you select Enable as Client, type the user name and password that the
FortiGate unit will need to authenticate itself to the remote peer.
To select Enable as Server, you must first create user groups to identify the
remote peers and dialup clients that need access to the network behind the
FortiGate unit. You must also configure the FortiGate unit to forward
authentication requests to an external RADIUS or LDAP authentication
server. For information about these topics, see the "Users and Authentication"
chapter of the FortiGate Administration Guide. Select a Server Type setting to
determine the type of encryption method to use between the FortiGate unit,
the XAuth client and the external authentication server, and then select the
user group from the User Group list.
Nat-traversal Enable this option if a NAT device exists between the local FortiGate unit and
the VPN peer or client. The local FortiGate unit and the VPN peer or client
must have the same NAT traversal setting (both selected or both cleared).
Keepalive If you enabled NAT traversal, enter a keepalive frequency setting. The value
represents an interval from 0 to 900 seconds.
Frequency
Dead Peer Enable this option to reestablish VPN tunnels on idle connections and clean
up dead IKE peers if required.
Detection
You configure phase 2 settings to specify the parameters for creating and maintaining
a VPN tunnel between the FortiGate unit and the remote peer or client. In most cases,
you only need to configure the basic phase 2 settings.
To configure phase 2 settings
1 Go to VPN > IPSEC > Phase 2.
2 Follow the general guidelines in these sections:
• "Phase 2 list" on page 261
• "Phase 2 basic settings" on page 261
• "Phase 2 advanced options" on page 262
For information about how to choose the correct phase 2 settings for your particular
situation, refer to the
Note: The procedures in this section assume that you want the FortiGate unit to generate
unique IPSec encryption and authentication keys automatically. In situations where a remote
VPN peer requires a specific IPSec encryption and/or authentication key, you must configure
the FortiGate unit to use manual keys instead. For more information, see
page 263.
FortiGate VPN Guide.
01-28008-0013-20050204
VPN
"Manual key" on
Fortinet Inc.