Fortinet FortiGate 4000 - Manual (Page 19)

Introduction VPN
FortiGate-4000 Installation and Configuration Guide
19
VPN
Using FortiGate virtual private networking (VPN), you can provide a secure
connection between widely separated office networks or securely link telecommuters
or travellers to an office network. Service providers can also use the FortiGate unit to
provide VPN services for their clients.
FortiGate VPN features include the following:
• Industry standard and ICSA-certified IPSec VPN, including:
• IPSec, ESP security in tunnel mode,
• DES, 3DES (triple-DES), and AES hardware accelerated encryption,
• HMAC MD5 and HMAC SHA1 authentication and data integrity,
• AutoIKE key based on pre-shared key tunnels,
• IPSec VPN using local or CA certificates,
• Manual Keys tunnels,
• Diffie-Hellman groups 1, 2, and 5,
• Aggressive and Main Mode,
• Replay Detection,
• Perfect Forward Secrecy,
• XAuth authentication,
• Dead peer detection.
• PPTP for easy connectivity with the VPN standard supported by the most popular
operating systems.
• L2TP for easy connectivity with a more secure VPN standard, also supported by
many popular operating systems.
• Firewall policy based control of IPSec VPN traffic.
• IPSec NAT traversal so that remote IPSec VPN gateways or clients behind a NAT
can connect to an IPSec VPN tunnel.
• VPN hub and spoke using a VPN concentrator to allow VPN traffic to pass from
one tunnel to another through the FortiGate unit.
• IPSec Redundancy to create a redundant AutoIKE key IPSec VPN connection to a
remote network.
High availability
High Availability (HA) provides failover between two or more FortiGate units. Fortinet
achieves HA by using redundant hardware: matching FortiGate models running in
NAT/Route mode. You can configure the FortiGate units for either active-passive (A-P)
or active-active (A-A) HA.
Both A-P and A-A HA use similar redundant hardware configurations. High availability
software guarantees that if one of the FortiGate units in the HA group fails, all
functions, established firewall connections, and IPSec VPN sessions are maintained.