IPSec
IPSec set up
Define routing policies for an IPSec VPN
FortiWAN's intelligent routing function (Auto Routing and Tunnel Routing) transferred all packets, including packets of
IPSec, outward over multiple WAN links. Although an IPSec configuration specifies the IP addresses of the WAN ports
(Phase 1: Local IP and Remote IP) used to establish the IPSec VPN and the IP addresses that Quick Mode selectors
evaluate for, it does not imply the correspondent routing for the IPSec packets. You are required to have extra rules of
Auto Routing or Tunnel Routing setting manually to fixedly route the IPSec packets to correct WAN port.
The IPSec packets we are talking about consist of the packets of 2 phases IKE negotiations (called "IKE packets" here)
and the packets of IPSec VPN communications (called "ESP packets" here). An IKE packet comes from the local
FortiWAN unit and its source IP address is just the configured Local IP (a WAN port); an ESP packet comes from a
private network behind the local FortiWAN and its source IP address is a private IP address. The followings describe
the procedures defining related policies for "IPSec Tunnel mode" and "Tunnel Routing over IPSec Transport mode".
Define Auto Routing and NAT policies for an IPSec Tunnel-mode VPN
For IPSec Tunnel Mode, you need to make sure connections of both IKE and ESP packets are fixedly routed by Auto
Routing to the WAN port that is configured as the Local IP of the IPSec VPN tunnel.
Example topology for the following policies
For this example topology, we need to have configurations of
Network Setting
,
Auto Routing
,
NAT
and
IPSec
as
follows:
Network Setting
Network Settings on the both sides:
198
FortiWAN Handbook
Fortinet Technologies Inc.
