IPSec VPN Concepts
IPSec
The above diagram shows an IPSec VPN connection between two private networks, which two FortiWAN units (two
endpoints of the VPN tunnel) functions as the IPSec VPN gateways for. The IPSec VPN tunnel is established through
public IP addresses (for example 1.1.1.1 and 2.2.2.2) of FortiWAN's WAN interfaces. FortiWAN A receives packets
from site A network (192.168.1.0/24) with source IP 192.168.1.10 and destination IP 192.168.2.10 (site B network),
and then performs:
l
encrypt packets with shared security parameters (algorithms and secret keys)
l
encapsulate packets with a new IP header that source IP is 1.1.1.1 and destination IP is 2.2.2.2.
l
forward packets to the site B network (FortiWAN B)
FortiWAN B receives the packets and performs:
l
recover the encrypted packets by decapsulation
l
recover the original data and IP header by decryption
l
forward packets to host 192.168.2.10
Processes for traffic in the opposite direction are the same. From the standpoint of FortiWAN A, FortiWAN A is local
unit and FortiWAN B is the remote unit, vice versa.
IPSec key exchange
After the basic concept of IPSec VPN introduced above, here comes the details of IPSec's key exchange processes
which is the major part to configure an IPSec VPN. As the previous discussion, IPSec performs data encryption and
authentication for the VPN communications. The way to securely distribute a common secret key to each endpoint is
essential to make the secure data transmission complete. After all, a encrypted data is no longer secure if its secret
FortiWAN Handbook
Fortinet Technologies Inc.
173
