VPN spoke general configuration steps

IPSec VPN

 

 

VPN spoke general configuration steps

A remote VPN peer that is functioning as a spoke requires the following configuration:

A tunnel (AutoIKE phase 1 and phase 2 configuration or manual key configuration) for the hub.

The source address of the local VPN spoke.

The destination address of each remote VPN spoke.

A separate outbound encrypt policy for each remote VPN spoke. These policies allow the local VPN spoke to initiate encrypted connections.

A single inbound encrypt policy. This policy allows the local VPN spoke to accept encrypted connections.

To create a VPN spoke configuration:

1Configure a tunnel between the spoke and the hub. Choose between a manual key tunnel or an AutoIKE tunnel.

To add a manual key tunnel, see “Manual key IPSec VPNs” on page 183.

To add an AutoIKE tunnel, see: “AutoIKE IPSec VPNs” on page 185.

2Add the source address. One source address is required for the local VPN spoke. See “Adding a source address” on page 197.

3Add a destination addresses for each remote VPN spoke. The destination address is the address of the spoke (either a client on the Internet or a network located behind a gateway).

See “Adding a destination address” on page 197

4Add a separate outbound encrypt policy for each remote VPN spoke. These policies control the encrypted connections initiated by the local VPN spoke.

The encrypt policy must include the appropriate source and destination addresses and the tunnel added in step 1. Use the following configuration:

Source

The local VPN spoke address.

Destination

The remote VPN spoke address.

Action

ENCRYPT

VPN Tunnel

The VPN tunnel name added in step 1. (Use the same tunnel for all encrypt

 

policies.)

Allow inbound

Do not enable.

Allow outbound Select allow outbound

Inbound NAT

Select inbound NAT if required.

Outbound NAT

Select outbound NAT if required.

See “Adding an encrypt policy” on page 197.

5Add an inbound encrypt policy. This policies controls the encrypted connections initiated by the remote VPN spokes.

The encrypt policy for the hub must include the appropriate source and destination addresses and the tunnel added in step 1. Use the following configuration:

Source

The local VPN spoke address.

Destination

External_All

202

Fortinet Inc.

Page 202
Image 202
Fortinet 100 user manual VPN spoke general configuration steps, 202, VPN Tunnel, Policies, Destination ExternalAll