Fortinet FortiGate 4000 - Manual (Page 244)

244
Fortinet Inc.
AutoIKE IPSec VPNs IPSec VPN
Adding a phase 2 configuration for an AutoIKE VPN
Add a phase 2 configuration to specify the parameters used to create and maintain a
VPN tunnel between the local VPN peer (the FortiGate unit) and the remote VPN peer
(the VPN gateway or client).
To add a phase 2 configuration
1 Go to VPN > IPSEC > Phase 2.
2 Select New to add a new phase 2 configuration.
3 Enter a Tunnel Name.
The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), and
the special characters - and _. Other special characters and spaces are not allowed.
4 Select a Remote Gateway to associate with the VPN tunnel.
A remote gateway can be either a gateway to another network or an individual client
on the Internet. Remote gateways are added as part of the phase 1 configuration. For
details, see
“Adding a phase 1 configuration for an AutoIKE VPN” on page 239 .
Choose either a single DIALUP remote gateway, or up to three STATIC remote
gateways. Multiple STATIC remote gateways are necessary if you are configuring
IPSec redundancy.
5 Configure the P2 Proposal.
Select up to three encryption and authentication algorithm combinations to propose
for phase 2.
The VPN peers must use the same P2 proposal settings.
6 Optionally, enable Replay Detection.
Replay detection protects the VPN tunnel from replay attacks.
7 Optionally, enable Perfect Forward Secrecy (PFS).
PFS improves security by forcing a new Diffie-Hellman exchange whenever keylife
expires.
8 Select the DH Group(s).
The VPN peers must use the same DH Group settings.
9 Enter the Keylife.
The keylife causes the phase 2 key to expire after a specified time, after a specified
number of Kbytes of data have been processed by the VPN tunnel, or both. If you
select both, the key does not expire until both the time has passed and the number of
Kbytes have been processed.
When the key expires, a new key is generated without interrupting service. P2
proposal keylife can be from 120 to 172800 seconds or from 5120 to 99999 Kbytes.
Note: Adding a Phase 2 configuration is the same for pre-shared key and certification VPNs.
Note: Do not select replay detection if you have also selected Null Authentication for the P2
Proposal.