Fortinet FortiGate 4000 - Manual (Page 254)

254
Fortinet Inc.
IPSec VPN concentrators IPSec VPN
If the VPN peer is one of the spokes, it requires a tunnel connecting it to the hub (but
not to the other spokes). It also requires policies that control its encrypted connections
to the other spokes and its non-encrypted connections to other networks, such as the
Internet.
• VPN concentrator (hub) general configuration steps
• Adding a VPN concentrator
• VPN spoke general configuration steps
VPN concentrator (hub) general configuration steps
A central FortiGate that is functioning as a hub requires the following configuration:
• A tunnel (AutoIKE phase 1 and phase 2 configuration or manual key configuration)
for each spoke.
• Destination addresses for each spoke.
• A concentrator configuration.
• An encrypt policy for each spoke.
To create a VPN concentrator configuration
1 Configure one of the following tunnels for each spoke:
• A manual key tunnel consists of a name for the tunnel, the IP address of the spoke
(client or gateway) at the opposite end of the tunnel, and the encryption and
authentication algorithms to use for the tunnel.
See
“Manual key IPSec VPNs” on page 237 .
• An AutoIKE tunnel consists of phase 1 and phase 2 parameters. The phase 1
parameters include the name of the spoke (client or gateway), designation of how
the spoke receives its IP address (static or dialup), encryption and authentication
algorithms, and the authentication method (either pre-shared keys or PKI
certificates). The phase 2 parameters include the name of the tunnel, selection of
the spoke (client or gateway) configured in phase 1, encryption and authentication
algorithms, and a number of security parameters.
See
“AutoIKE IPSec VPNs” on page 239 .
2 Add a destination address for each spoke. The destination address is the address of
the spoke (either a client on the Internet or a network located behind a gateway).
See
“Adding a source address” on page 250 .
3 Add the concentrator configuration. This step groups the tunnels together on the
FortiGate unit. The tunnels link the hub to the spokes. The tunnels are added as part
of the AutoIKE phase 2 configuration or the manual key configuration.
See
“Adding a VPN concentrator” on page 255 .
4 Add an encrypt policy for each spoke. Encrypt policies control the direction of traffic
through the hub and allow inbound and outbound VPN connections between the hub
and the spokes. The encrypt policy for each spoke must include the tunnel name of
the spoke. The source address must be Internal_All. Use the following configuration
for the encrypt policies:
Note: Add the concentrator configuration to the central FortiGate unit (the hub) after adding the
tunnels for all spokes.