Fortinet FortiGate FortiGate-100A, Руководство администратора

Страница: 280 / 388

280
01-28006-0068-20041105 Fortinet Inc.
Setting the encryption policy direction VPN
Manual key IPSec VPN
To use Manual key IPSec VPNs, both ends of the VPN tunnel must be configured with
matching encryption and authentication algorithms and with matching authentication
and encryption keys and complementary security parameter index (SPI) settings.
To configure manual key VPN
1 Add the a manual key configuration to both VPN peers.
See
“Manual key” on page 253 .
2 Both configurations must be identical except for the local and remote SPIs.
See
“Manual key” on page 253 .
3 Add the firewall configuration required for the VPN.
See
“Adding firewall policies for IPSec VPN tunnels” on page 280 .
Adding firewall policies for IPSec VPN tunnels
Firewall policies for IPSec VPN control all VPN traffic passing through the FortiGate
unit. You add firewall policies for IPSec VPN in the same way as you add normal
firewall policies. See
“Policy” on page 190 for information about firewall policies.
You can also use firewall policies for IPSec VPN to apply protection profiles to VPN
traffic, to log IPSec VPN traffic, and to apply advanced features to IPSec VPN traffic
such as traffic shaping and differentiated services.
Adding a firewall policy for an IPSec VPN involves creating an internal-> external
policy, setting the policy action to ENCRYPT, and selecting the VPN tunnel that is to
use the policy.
Setting the encryption policy direction
Only one firewall policy is required to enable two-way traffic. The Interface/Zone
Source setting must correspond to an interface that is connected to a network or
device behind the FortiGate unit, and the Interface/Zone Destination setting must
correspond to an interface that is connected to the Internet, a remote network, a
remote VPN peer, or a remote VPN client.
Setting the source address for encrypted traffic
The source address is typically an IP address or a range of IP addresses behind the
FortiGate unit. The source address controls the IP addresses that remote VPN peers
and/or clients can access. To add a source address, see
“To add an address” on
page 200 .