Fortinet FortiGate FortiGate-500A, Administration Manual

Page: 254 / 394

254
01-28006-0100-20041105 Fortinet Inc.
Phase 2 VPN
Phase 2
You configure the AutoIKE phase 2 settings to specify the parameters used to create
and maintain a VPN tunnel between the local VPN peer (the FortiGate unit) and the
remote VPN peer (the VPN gateway or client).
In most cases, you only need to configure the basic phase 2 settings.
To configure phase 2 settings
1 Go to VPN > IPSEC > Phase 2 .
2 Select Create New to create a new VPN tunnel or select an existing tunnel to
configure.
Phase 2 list
Figure 123:IPSec VPN Phase 2 list
XAuth: Enable as Server
Server type
Select the type of encryption method used between the XAuth client, the
FortiGate unit and the authentication server.
PAP — Password Authentication Protocol.
CHAP — Challenge-Handshake Authentication Protocol.
MIXED —Select MIXED to use PAP between the XAuth client and the
FortiGate unit, and CHAP between the FortiGate unit and the
authentication server.
Use CHAP whenever possible. Use PAP if the authentication server does
not support CHAP. (Use PAP with all implementations of LDAP and some
implementations of Microsoft RADIUS). Use MIXED if the authentication
server supports CHAP but the XAuth client does not. (Use MIXED with the
Fortinet Remote VPN Client.).
User Group Select a group of users to be authenticated by XAuth. The individual users
within the group can be authenticated locally or by one or more LDAP or
RADIUS servers.
The user group must be added to the FortiGate configuration before it can
be selected here.
Create New Select Create New to add a Phase 2 configuration, also called a VPN
tunnel.
Tunnel Name The names of the Phase 2 configurations (VPN tunnels) added.
Remote Gateway The the name of the remote gateway (phase 1 configuration) associated
with this phase 2 configuration.
Lifetime (sec/kb) The tunnel key lifetime.