Fortinet FortiGate FortiGate-1000, Administration Manual

Page: 253 / 392

VPN Phase 2
FortiGate-1000 Administration Guide 01-28006-0009-20041105
253
Phase 2 basic settings
Figure 124:Phase 2 basic settings
Status The current status of the tunnel. Down, tunnel is not processing traffic.
Up, the tunnel is currently processing traffic. Unknown, status of Dialup
tunnels. See “Monitor” on page 259 for more information.
Timeout If the tunnel is processing VPN traffic, the amount of time left before the
next phase 2 key exchange. When the phase 2 key expires, a new key is
generated without interrupting service.
Edit, view or delete phase 2 configurations.
Tunnel Name Type a name for the tunnel.
Remote
Gateway Select the remote gateway to assign to this tunnel. A remote gateway
provides a connection to another network or an individual client on the
Internet. You define remote gateways on the Phase 1 tab. For details, see
“Phase 1” on page 248 .
Select the name of an existing Phase 1 configuration from the Dialup User
section of the list if the tunnel will be used to connect a single remote VPN
peer that uses either a dynamic IP address or a static IP address that is not
used during the peer identification process. For information about how to
create a Phase 1 Dialup User configuration, see “Dialup VPN” on page 281 .
If the tunnel is to connect a static remote gateway, select the name of an
existing Phase 1 configuration from the Static IP Address section of the list.
See “Gateway-to-gateway VPN” on page 280 for information about how to
define a Phase 1 Static IP Address configuration. You can associate up to
three static remote gateways with the same tunnel. Multiple static remote
gateways are needed to configure IPSec redundancy. Use the add and
subtract buttons beside the field to increase or decrease the number of static
remote gateways associated with this VPN tunnel. For information about
IPSec redundancy, see “Redundant IPSec VPNs” on page 289 .
If the FortiGate unit will get the IP address of the remote VPN peer by looking
up a domain name, select the name of an existing Phase 1 configuration from
the Dynamic DNS section of the list. For information about how to create a
Phase 1 Dynamic DNS configuration, see “Dynamic DNS VPN” on page 281 .
Concentrator Select a concentrator if you want to add the tunnel to an existing VPN
concentrator. Concentrators are employed in hub and spoke VPN
configurations. You define concentrators on the Concentrator tab. for details,
see “Concentrator” on page 257 .