Fortinet FortiGate FortiGate-100A, Руководство администратора

Страница: 276 / 388

276
01-28006-0068-20041105 Fortinet Inc.
ipsec vip VPN
Example
Use the following commands to edit an existing phase 2 configuration named
Tunnel_1
. The command binds the tunnel to the interface named
internal
.
config vpn ipsec phase2
edit Tunnel_1
set bindtoif internal
end
ipsec vip
A FortiGate unit can act as a proxy by answering ARP requests locally and forwarding
the associated traffic to the intended destination host over an IPSec VPN tunnel. The
feature is intended to enable IPSec VPN communications between two hosts that
coordinate the same private address space on physically separate networks. The IP
addresses of both the source host and the destination host must be unique. The
ipsec vip
command lets you specify the IP addresses that can be accessed at the
remote end of the VPN tunnel. You must configure IPSec virtual IP (VIP) addresses at
both ends of the IPSec VPN tunnel.
Adding an IPSec VIP entry to the VIP table enables a FortiGate unit to respond to
ARP requests destined for remote servers and route traffic to the intended
destinations automatically. Each IPSec VIP entry is identified by an integer. An entry
identifies the name of the FortiGate interface to the destination network, and the IP
address of a destination host on the destination network. Specify an IP address for
every host that needs to be accessed on the other side of the tunnel—you can define
a maximum of 32 IPSec VIP addresses on the same interface.
For more information, see “Configuring IPSec virtual IP addresses” on page 288 .
Command syntax pattern
config vpn ipsec vip
edit <vip_integer>
set <keyword> <variable>
end
ipsec phase2 command keywords and variables
Keywords and variables Description Default Availability
bindtoif
<interface-name_str>
Bind the tunnel to the specified
network interface. Type the name of
the local FortiGate interface.
No
default.
All models.
Note: The interface to the destination network must be associated with a VPN tunnel through a
firewall encryption policy (
action
must be set to
encrypt
). The policy determines which VPN
tunnel will be selected to forward traffic to the destination. When you create IPSec VIP entries,
check the encryption policy on the FortiGate interface to the destination network to ensure that
it meets your requirements.