Manual key IPSec VPN
Manual key IPSec VPN
Adding firewall policies for IPSec VPN tunnels
Setting the encryption policy direction
Setting the source address for encrypted traffic
268
To use Manual key IPSec VPNs, both ends of the VPN tunnel must be configured with
matching encryption and authentication algorithms and with matching authentication
and encryption keys and complementary security parameter index (SPI) settings.
To configure manual key VPN
1
Add the a manual key configuration to both VPN peers.
See
"Manual key" on page
2
Both configurations must be identical except for the local and remote SPIs.
See
"Manual key" on page
3
Add the firewall configuration required for the VPN.
See
"Adding firewall policies for IPSec VPN tunnels" on page
Firewall policies for IPSec VPN control all VPN traffic passing through the FortiGate
unit. You add firewall policies for IPSec VPN in the same way as you add normal
firewall policies. See
You can also use firewall policies for IPSec VPN to apply protection profiles to VPN
traffic, to log IPSec VPN traffic, and to apply advanced features to IPSec VPN traffic
such as traffic shaping and differentiated services.
Adding a firewall policy for an IPSec VPN involves creating an internal-> external
policy, setting the policy action to ENCRYPT, and selecting the VPN tunnel that is to
use the policy.
Only one firewall policy is required to enable two-way traffic. The Interface/Zone
Source setting must correspond to an interface that is connected to a network or
device behind the FortiGate unit, and the Interface/Zone Destination setting must
correspond to an interface that is connected to the Internet, a remote network, a
remote VPN peer, or a remote VPN client.
The source address is typically an IP address or a range of IP addresses behind the
FortiGate unit. The source address controls the IP addresses that remote VPN peers
and/or clients can access. To add a source address, see
page
188.
241.
241.
"Policy" on page 178
01-28006-0001-20041105
268.
for information about firewall policies.
"To add an address" on
VPN
Fortinet Inc.
Need help?
Do you have a question about the FortiGate FortiGate-50A and is the answer not in the manual?
Questions and answers