IPSec
IPSec set up
Between any two FortiWANs, we cannot terminate traffic through multiple IPSec connections on the same local or
remote IP address. This limitation exists in both of the IPSec types: IPSec Tunnel mode and IPSec Transport mode,
so that
Tunnel Routing over IPSec Transport mode
is involved indirectly. You have to give careful consideration
to the issue when planing how to deploy the IPSec VPN (and Tunnel Routing) between multiple FortiWANs.
Planning your VPN
Building a VPN between sites might involve complex association with sites and confusing configurations. Beginning
hastily to configure settings without a comprehensive plan usually causes failure. Making a plan in advance for your
VPN topology is a great help to the next VPN configurations. The following considerations help you determine the VPN
topology and necessary information for configurations.
The locations of the sites that the site-to-site traffic originates from and needs to be delivered to
l
Choose the network sites that they need to communicate to each other through the VPN and define what kind of
communication it is (what kind of services provided in a network site and what kind of services that users in a
network site need to access).
The networks, individual hosts or server frames participating in the VPN communications
l
A network site consists of hosts, servers, and/or networks (private IP addresses deployment). You need to
determine the participating private IP addresses (the source and destination of traffic) and make policies to permit
traffic to pass through the VPN.
The VPN devices used to build the VPN
l
A site-to-site VPN (tunnels) between two FortiWAN units, or a FortiWAN unit and a FortiGate unit.
The network interfaces that two VPN devices communicate through
l
For any VPN tunnel between two VPN devices, you need to determine the participating network interface for each
end-point. This implies the public IP addresses (local IP and remote IP) used to establish a VPN tunnel through
Internet. Note that only static IP addresses are supported.
l
One WAN interface cannot serve for more than one IPSec connectivity between any two FortiWAN devices. You
need to take this for consideration when you determine the topology. See "
Limitation in the IPSec deployment
" for
the details.
The VPN device interfaces that a private network accesses the VPN through
l
The private IP addresses associated with the VPN device interfaces to the private networks. Hosts in the private
network behind the VPN device access VPN through these interface. Traffic is forwarded between the VPN tunnels
and the private networks on each site.
The types used to build the VPN
l
IPSec protected VPN without bandwidth aggregation and fault tolerance: IPSec Tunnel mode.
l
IPSec protected VPN with bandwidth aggregation and fault tolerance: Tunnel Routing over IPSec Transport mode.
l
VPN with bandwidth aggregation and fault tolerance: Tunnel Routing (See "
").
184
FortiWAN Handbook
Fortinet Technologies Inc.
