Manual Key Ipsec Vpn; Adding Firewall Policies For Ipsec Vpn Tunnels; Setting The Encryption Policy Direction; Setting The Source Address For Encrypted Traffic - Fortinet FortiGate FortiGate-800 Administration Manual

Manual key IPSec VPN

Manual key IPSec VPN

Adding firewall policies for IPSec VPN tunnels

Setting the encryption policy direction

Setting the source address for encrypted traffic

282
To use Manual key IPSec VPNs, both ends of the VPN tunnel must be configured with
matching encryption and authentication algorithms and with matching authentication
and encryption keys and complementary security parameter index (SPI) settings.
To configure manual key VPN
1 Add the a manual key configuration to both VPN peers.
See "Manual key" on page
2 Both configurations must be identical except for the local and remote SPIs.
See "Manual key" on page
3 Add the firewall configuration required for the VPN.
See "Adding firewall policies for IPSec VPN tunnels" on page
Firewall policies for IPSec VPN control all VPN traffic passing through the FortiGate
unit. You add firewall policies for IPSec VPN in the same way as you add normal
firewall policies. See
You can also use firewall policies for IPSec VPN to apply protection profiles to VPN
traffic, to log IPSec VPN traffic, and to apply advanced features to IPSec VPN traffic
such as traffic shaping and differentiated services.
Adding a firewall policy for an IPSec VPN involves creating an internal-> external
policy, setting the policy action to ENCRYPT, and selecting the VPN tunnel that is to
use the policy.
Only one firewall policy is required to enable two-way traffic. The Interface/Zone
Source setting must correspond to an interface that is connected to a network or
device behind the FortiGate unit, and the Interface/Zone Destination setting must
correspond to an interface that is connected to the Internet, a remote network, a
remote VPN peer, or a remote VPN client.
The source address is typically an IP address or a range of IP addresses behind the
FortiGate unit. The source address controls the IP addresses that remote VPN peers
and/or clients can access. To add a source address, see
page 204.
255.
255.
"Policy" on page 194
01-28006-0008-20041105
282.
for information about firewall policies.
"To add an address" on
VPN
Fortinet Inc.