Fortinet FortiGate 100A, Руководство администратора

Страница: 270 / 374

270
01-28007-0068-20041203 Fortinet Inc.
ipsec phase1 VPN
Example
Use the following command to edit an IPSec VPN phase 1 configuration with the
following characteristics:
• Phase 1 configuration name:
Simple_GW
• Remote peer address type:
Dynamic
• Encryption and authentication proposal:
des-md5
• Authentication method:
psk
• Pre-shared key:
Qf2p3O93jIj2bz7E
• Mode:
aggressive
• Dead Peer Detection:
enable
• Long idle:
1000
• Short idle:
150
• Retry count:
5
• Retry interval:
30
config vpn ipsec phase1
edit Simple_GW
set Type dynamic
set proposal des-md5
set authmethod psk
set psksecret Qf2p3O93jIj2bz7E
set mode aggressive
set dpd enable
set dpd-idlecleanup 1000
set dpd-idleworry 150
set dpd-retrycount 5
set dpd-retryinterval 30
end
dpd-retrycount
<retry_integer>
The DPD retry count when
dpd
is set to
enable
. Set the number of times that the
local VPN peer sends a DPD probe before
it considers the link to be dead and tears
down the security association (SA). The
dpd-retrycount
range is 0 to 10.
To avoid false negatives due to congestion
or other transient failures, set the retry
count to a sufficiently high value for your
network.
3 All models.
dpd
must
be set to
enable
.
dpd-retryinterval
<seconds_integer>
The DPD retry interval when
dpd
is set to
enable
. Set the time, in seconds, that the
local VPN peer waits between sending DPD
probes. The
dpd-retryinterval
range
is 1 to 60.
5
seconds
All models.
dpd
must
be set to
enable
.
ipsec phase1 command keywords and variables (Continued)
Keywords and
variables Description Default Availability