IPSec set up
IPSec
IPSec VPN in the Web UI
The configurations introduced in this section are based on the deployment of FortiWAN-to-FortiWAN. For the IPSec
VPN established between a FortiWAN unit and a FortiGate unit, see "
Establish IPSec VPN with FortiGate
". This
section focus on the configurations of IPSec protected VPN, IPSec Tunnel mode and Tunnel Routing over IPSec
Transport mode. For configurations of Tunnel Routing, see "
".
To set up the IPSec VPN between two FortiWAN units, the following steps are necessary for each of the endpoints.
1. Define IKE Phase 1 parameters for establishment of ISAKMP Security Association with authenticated a remote
peer.
2. Define IKE Phase 2 parameters for establishment of IPSec Security Association with authenticated a remote peer.
3. Create correspondent policies of NAT, Auto Routing (AR) and Tunnel Routing (TR) to correctly route the packets of
IKE negotiations and IPSec VPN communications (will be discussed in next section, see "
Define routing policies for an
").
Configurations of IKE Phase 1
An IPSec VPN tunnel involves the connection of two FortiWAN units. Most of the settings used to establish an IPSec
VPN tunnel are required to be corresponding on the both endpoints. Therefore, it is better to collect enough
information in preparation for the configurations of an IPSec VPN tunnel.
Here are the items and information that you need to determine for IKE Phase 1 settings:
Defining the remote and local ends of the IPSec VPN tunnel
Basically, this is to specify the public IP addresses for the two ends (a local FortiWAN unit and a remote FortiWAN unit)
of the IPSec VPN tunnel. The IPSec VPN tunnel is established through connection of the two public IP addresses. You
need to determine the WAN link of a FortiWAN unit to connect with each other for an IPSec VPN tunnel; and the IP
addresses deployed on the two WAN ports are actually the two ends (local IP and remote IP) of the IPSec VPN tunnel.
FortiWAN's IPSec VPN does not support dynamic IP addresses; it is only available for the WAN links that are deployed
as
Routing Mode
,
Bridge Mode: One Static IP
or
Bridge Mode: Multiple Static IP
(see "
" for details). For the settings of a IPSec VPN tunnel configured on the two endpoints, the Local IP of a FortiWAN
unit becomes the Remote IP of the opposite FortiWAN unit and vice versa. An IPSec VPN tunnel consists of the IKE
negotiations (for the security associations, SAs) and the data transmission tunnel; both are established through the
two public IP addresses. You also have to give consideration to the limitation that we cannot deploy multiple IPSec
connections between any two FortiWANs on the same local or remote IP address. See "
" for details.
A pre-shared key used to authenticate the FortiWAN unit to the remote unit
During the IKE Phase 1 negotiations, a FortiWAN unit need to authenticate itself to the remote unit by a pre-shared
key. The two endpoints of an IPSec VPN tunnel share a common key in advance, so that they can authenticate itself to
each other with the common key, like a password. You need to distribute the pre-shared key in a secure way. The pre-
shared key configured on the two endpoints of a IPSec VPN tunnel must be equal, or the establishment of IPSec
Security Association goes to failure (failed authentication results in failure of IKE Phase 1 and Phase 2.
FortiWAN Handbook
Fortinet Technologies Inc.
185
Содержание FortiWAN
Страница 1: ...FortiWAN Handbook VERSION 4 2 1...
