Fortinet FortiGate-800 manual VPN concentrator hub general configuration steps, 250

IPSec VPN concentrators IPSec VPN

If the VPN peer is one of the spokes, it requires a tunnel connecting it to the hub (but not to the other spokes). It also requires policies that control its encrypted connections to the other spokes and its non-encrypted connections to other networks, such as the Internet.

•VPN concentrator (hub) general configuration steps

•Adding a VPN concentrator

•VPN spoke general configuration steps

VPN concentrator (hub) general configuration steps

A central FortiGate that is functioning as a hub requires the following configuration:

•A tunnel (AutoIKE phase 1 and phase 2 configuration or manual key configuration) for each spoke.

•Destination addresses for each spoke.

•A concentrator configuration.

•An encrypt policy for each spoke.

To create a VPN concentrator configuration

1Configure one of the following tunnels for each spoke:

•A manual key tunnel consists of a name for the tunnel, the IP address of the spoke (client or gateway) at the opposite end of the tunnel, and the encryption and authentication algorithms to use for the tunnel.

See “Manual key IPSec VPNs” on page 233.

•An AutoIKE tunnel consists of phase 1 and phase 2 parameters. The phase 1 parameters include the name of the spoke (client or gateway), designation of how the spoke receives its IP address (static or dialup), encryption and authentication algorithms, and the authentication method (either pre-shared keys or PKI certificates). The phase 2 parameters include the name of the tunnel, selection of the spoke (client or gateway) configured in phase 1, encryption and authentication algorithms, and a number of security parameters.

See “AutoIKE IPSec VPNs” on page 235.

2Add a destination address for each spoke. The destination address is the address of the spoke (either a client on the Internet or a network located behind a gateway). See “Adding a source address” on page 246.

3Add the concentrator configuration. This step groups the tunnels together on the FortiGate unit. The tunnels link the hub to the spokes. The tunnels are added as part of the AutoIKE phase 2 configuration or the manual key configuration.

See “Adding a VPN concentrator” on page 251.

Note: Add the concentrator configuration to the central FortiGate unit (the hub) after adding the tunnels for all spokes.

4Add an encrypt policy for each spoke. Encrypt policies control the direction of traffic through the hub and allow inbound and outbound VPN connections between the hub and the spokes. The encrypt policy for each spoke must include the tunnel name of the spoke. The source address must be Internal_All. Use the following configuration for the encrypt policies:

250 Fortinet Inc.