Fortinet FortiGate-800 manual Adding a phase 2 configuration for an AutoIKE VPN, 240

AutoIKE IPSec VPNs IPSec VPN

Adding a phase 2 configuration for an AutoIKE VPN

Add a phase 2 configuration to specify the parameters used to create and maintain a VPN tunnel between the local VPN peer (the FortiGate unit) and the remote VPN peer (the VPN gateway or client).

Note: Adding a Phase 2 configuration is the same for pre-shared key and certification VPNs.

To add a phase 2 configuration

1Go to VPN > IPSEC > Phase 2.

2Select New to add a new phase 2 configuration.

3Enter a Tunnel Name.

The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), and the special characters - and _. Other special characters and spaces are not allowed.

4Select a Remote Gateway to associate with the VPN tunnel.

A remote gateway can be either a gateway to another network or an individual client on the Internet. Remote gateways are added as part of the phase 1 configuration. For details, see “Adding a phase 1 configuration for an AutoIKE VPN” on page 235.

Choose either a single DIALUP remote gateway, or up to three STATIC remote gateways. Multiple STATIC remote gateways are necessary if you are configuring IPSec redundancy. For information about IPSec redundancy, see “Redundant IPSec VPNs” on page 253.

5Configure the P2 Proposal.

Select up to three encryption and authentication algorithm combinations to propose for phase 2.

The VPN peers must use the same P2 proposal settings.

6Optionally, enable Replay Detection.

Replay detection protects the VPN tunnel from replay attacks.

Note: Do not select replay detection if you have also selected Null Authentication for the P2

Proposal.

7Optionally, enable Perfect Forward Secrecy (PFS).

PFS improves security by forcing a new Diffie-Hellman exchange whenever keylife expires.

8Select the DH Group(s).

The VPN peers must use the same DH Group settings.

9Enter the Keylife.

The keylife causes the phase 2 key to expire after a specified time, after a specified number of Kbytes of data have been processed by the VPN tunnel, or both. If you select both, the key does not expire until both the time has passed and the number of Kbytes have been processed.

When the key expires, a new key is generated without interrupting service. P2 proposal keylife can be from 120 to 172800 seconds or from 5120 to 99999 Kbytes.

240 Fortinet Inc.