![](/images/new-backgrounds/1267772/267772375x1.webp)
AutoIKE IPSec VPNs | IPSec VPN |
|
|
Adding a phase 2 configuration for an AutoIKE VPN
Add a phase 2 configuration to specify the parameters used to create and maintain a VPN tunnel between the local VPN peer (the FortiGate unit) and the remote VPN peer (the VPN gateway or client).
Note: Adding a Phase 2 configuration is the same for
To add a phase 2 configuration
1Go to VPN > IPSEC > Phase 2.
2Select New to add a new phase 2 configuration.
3Enter a Tunnel Name.
The name can contain numbers
4Select a Remote Gateway to associate with the VPN tunnel.
A remote gateway can be either a gateway to another network or an individual client on the Internet. Remote gateways are added as part of the phase 1 configuration. For details, see “Adding a phase 1 configuration for an AutoIKE VPN” on page 183.
Choose either a single DIALUP remote gateway, or up to three STATIC remote gateways. Multiple STATIC remote gateways are necessary if you are configuring IPSec redundancy.
5Configure the P2 Proposal.
Select up to three encryption and authentication algorithm combinations to propose for phase 2.
The VPN peers must use the same P2 proposal settings.
6Optionally, enable Replay Detection.
Replay detection protects the VPN tunnel from replay attacks.
Note: Do not select replay detection if you have also selected Null Authentication for the P2
Proposal.
7Optionally, enable Perfect Forward Secrecy (PFS).
PFS improves security by forcing a new
8Select the DH Group(s).
The VPN peers must use the same DH Group settings.
9Enter the Keylife.
The keylife causes the phase 2 key to expire after a specified time, after a specified number of Kbytes of data have been processed by the VPN tunnel, or both. If you select both, the key does not expire until both the time has passed and the number of Kbytes have been processed.
When the key expires, a new key is generated without interrupting service. P2 proposal keylife can be from 120 to 172800 seconds or from 5120 to 99999 Kbytes.
188 | Fortinet Inc. |