Planning your VPN
It is a good idea to plan the VPN configuration ahead of time. This will save time later and help you configure your VPN correctly.
All VPN configurations are comprised of numerous required and optional parameters. Before you begin, you need to determine:
l Where the IP traffic originates and where it needs to be delivered l Which hosts, servers, or networks to include in the VPN l Which VPN devices to include in the configuration l Through which interfaces the VPN devices communicate l Through which interfaces do private networks access the VPN gateways
Once you have this information, you can select a VPN topology that suits the network environment.
Network topologies
The topology of your network will determine how remote peers and clients connect to the VPN and how VPN traffic is routed.
VPN network topologies and brief descriptions
| Topology | Description |
| Gateway-to-gateway configurations | Standard one-to-one VPN between two FortiGate units. See Gateway-togateway configurations on page 1. |
| Hub-and-spoke configurations | One central FortiGate unit has multiple VPNs to other remote FortiGate units. See Hub-and-spoke configurations on page 1. |
| Dynamic DNS configuration | One end of the VPN tunnel has a changing IP address and the other end must go to a dynamic DNS server for the current IP address before establishing a tunnel. See Dynamic DNS configuration on page 1. |
| FortiClient dialup-client configurations | Typically remote FortiClient dialup-clients use dynamic IP addresses through NAT devices. The FortiGate unit acts as a dialup server allowing dialup VPN connections from multiple sources. See FortiClient dialup-client configurations on page 1. |
| FortiGate dialup-client configurations | Similar to FortiClient dialup-client configurations but with more gateway-togateway settings such as unique user authentication for multiple users on a single VPN tunnel. See FortiGate dialup-client configurations on page 1. |
| Internet-browsing configuration | Secure web browsing performed by dialup VPN clients, and/or hosts behind a remote VPN peer. See Internet-browsing configuration on page 1. |
| Topology | Description |
| Redundant VPN
configurations |
Options for supporting redundant and partially redundant IPsec VPNs, using route-based approaches. See Redundant VPN configurations on page 1. |
| Transparent mode VPNs | In transparent mode, the FortiGate acts as a bridge with all incoming traffic being broadcast back out on all other interfaces. Routing and NAT must be performed on external routers. See Transparent mode VPNs on page 1. |
| L2TP and IPsec (Microsoft VPN) | Configure VPN for Microsoft Windows dialup clients using the built in L2TP software. Users do not have to install any See L2TP and IPsec (Microsoft VPN) on page 1. |
These sections contain high-level configuration guidelines with cross-references to detailed configuration procedures. If you need more detail to complete a step, select the cross-reference in the step to drill-down to more detail. Return to the original procedure to complete the procedure. For a general overview of how to configure a VPN, see Planning your VPN .
General preparation steps
A VPN configuration defines relationships between the VPN devices and the private hosts, servers, or networks making up the VPN. Configuring a VPN involves gathering and recording the following information. You will need this information to configure the VPN.
- The private IP addresses of participating hosts, servers, and/or networks. These IP addresses represent the source addresses of traffic that is permitted to pass through the VPN. A IP source address can be an individual IP address, an address range, or a subnet address.
- The public IP addresses of the VPN end-point interfaces. The VPN devices establish tunnels with each other through these interfaces.
- The private IP addresses associated with the VPN-device interfaces to the private networks. Computers on the private networks behind the VPN gateways will connect to their VPN gateways through these interfaces.
How to use this guide to configure an IPsec VPN
This guide uses a task-based approach to provide all of the procedures needed to create different types of VPN configurations. Follow the step-by-step configuration procedures in this guide to set up the VPN.
The following configuration procedures are common to all IPsec VPNs:
- Define the Phase 1 parameters that the FortiGate unit needs to authenticate remote peers or clients and establish a secure a connection. See Phase 1 parameters on page 46.
- Define the Phase 2 parameters that the FortiGate unit needs to create a VPN tunnel with a remote peer or dialup client. See Phase 2 parameters on page 66.
- Specify the source and destination addresses of IP packets that are to be transported through the VPN tunnel. See Defining policy addresses on page 1.
- Create an IPsec security policy to define the scope of permitted services between the IP source and destination addresses. See Defining VPN security policies on page 1.
These steps assume you configure the FortiGate unit to generate unique IPsec encryption and authentication keys automatically. In situations where a remote VPN peer or client requires a specific IPsec encryption and authentication key, you must configure the FortiGate unit to use manual keys instead of performing Steps 1 and 2.