Enter a name for the VPN topology.

Enter an optional description.

Select the topology type from the drop-down list. Select one of:

Define the IKE Profile. Configure IKE Phase 1, IKE Phase 2, Advanced settings, and Authentication settings.

Define the IKE Phase 1 proposal settings.

Select the encryption and authentication algorithms used to generate keys for protecting negotiations and add encryption and authentication algorithms as required.

You need to select a minimum of one and a maximum of three combinations. The remote peer or client must be configured to use at least one of the proposals that you define.

Select one of the following symmetric-key encryption algorithms:

Select either of the following authentication message digests to check the authenticity of messages during phase 1 negotiations:

To specify a third combination, use the Add button beside the fields for the second combination.

Select one or more Diffie-Hellman groups from DH group 1, 2, 5 and 14.

At least one of the DH Group settings on the remote peer or client must match one the selections on the FortiGate unit. Failure to match one or more DH groups will result in failed negotiations.

Note: Only one DH group is allowed for static and dynamic DNS gateways in aggressive mode.

Select either Aggressive or Main (ID Protection).

The FortiGate unit and the remote peer or dialup client exchange phase 1 parameters in either Main mode or Aggressive mode. This choice does not apply if you use IKE version 2, which is available only for route-based configurations.

In Main mode, the Phase 1 parameters are exchanged in multiple rounds with encrypted authentication information

In Aggressive mode, the Phase 1 parameters are exchanged in single message with authentication information that is not encrypted.

Although Main mode is more secure, you must select Aggressive mode if there is more than one dialup Phase 1 configuration for the interface IP address, and the remote VPN peer or client is authenticated using an identifier local ID). Descriptions of the peer options in this guide indicate whether Main or Aggressive mode is required.

Enter the time (in seconds) that must pass before the IKE encryption key expires. When the key expires, a new key is generated without interrupting service. The keylife can be from 120 to 172800 seconds.

Select this check box to reestablish VPN tunnels on idle connections and clean up dead IKE peers if required. You can use this option to receive notification whenever a tunnel goes up or down, or to keep the tunnel connection open when no traffic is being generated inside the tunnel. For example, in scenarios where a dialup client or dynamic DNS peer connects from an IP address that changes periodically, traffic may be suspended while the IP address changes.

Define the IKE Phase 2 proposal settings.

Note: When you define phase 2 parameters, you can choose any set of phase 1 parameters to set up a secure connection for the tunnel and authenticate the remote peer. Auto Key configuration applies to both tunnel-mode and interface-mode VPNs.

Select the encryption and authentication algorithms used to generate keys for protecting negotiations and add encryption and authentication algorithms as required.

You need to select a minimum of one and a maximum of three combinations. The remote peer or client must be configured to use at least one of the proposals that you define.

It is invalid to set both Encryption and Authentication to NULL.

Select one of the following symmetric-key encryption algorithms:

Select either of the following authentication message digests to check the authenticity of messages during phase 1 negotiations:

To specify a third combination, use the Add button beside the fields for the second combination.

Select one or more Diffie-Hellman groups from DH group 1, 2, 5 and 14.

At least one of the DH Group settings on the remote peer or client must match one the selections on the FortiGate unit. Failure to match one or more DH groups will result in failed negotiations.

Note: Only one DH group is allowed for static and dynamic DNS gateways in aggressive mode.

Select to enable or disable replay detection.

Replay attacks occur when an unauthorized party intercepts a series of IPsec packets and replays them back into the tunnel.

Select to enable or disable perfect forward secrecy (PFS).

Perfect forward secrecy (PFS) improves security by forcing a new Diffie-Hellman exchange whenever keylife expires.

Enter the PFS key life. Select Second, Kbytes, or Both from the drop-down list and enter the value in the text field.

Select to enable or disable autokey keep alive.

The phase 2 SA has a fixed duration. If there is traffic on the VPN as the SA nears expiry, a new SA is negotiated and the VPN switches to the new SA without interruption. If there is no traffic, the SA expires and the VPN tunnel goes down. A new SA will not be generated until there is traffic.

The Autokey Keep Alive option ensures that a new SA is negotiated even if there is no traffic so that the VPN tunnel stays up.

Select to enable or disable auto-negotiation.

 

Select the check box if a NAT device exists between the local FortiGate unit and the VPN peer or client. The local FortiGate unit and the VPN peer or client must have the same NAT traversal setting (both selected or both cleared) to connect reliably.

If you enabled NAT-traversal, enter a keep-alive frequency setting (10-900 seconds).

The FortiGate unit implements the Encapsulated Security Payload (ESP) protocol. Internet Key Exchange (IKE) is performed automatically based on pre-shared keys or X.509 digital certificates. As an option, you can specify manual keys. Interface mode, supported in NAT mode only, creates a virtual interface for the local end of a VPN tunnel.

If you selected Pre-shared Key, enter the pre-shared key that the FortiGate unit will use to authenticate itself to the remote peer or dialup client during phase 1 negotiations. You must define the same key at the remote peer or client. The key must contain at least 6 printable characters. For optimum protection against currently known attacks, the key must consist of a minimum of 16 randomly chosen alphanumeric characters.

Alternatively, you can select to generate a random pre-shared key.

If you selected Certificates, select the name of the server certificate that the FortiGate unit will use to authenticate itself to the remote peer or dialup client during phase 1 negotiations. For information about obtaining and loading the required server certificate, see the FortiOS User Authentication guide.

For more information on advanced option, see the FortiOS 5.0 CLI Reference.

Select to enable or disable FCC enforcement.

Select the version of IKE to use. This is available only if IPsec Interface Mode is enabled. For more information about IKE v2, refer to RFC 4306.

IKE v2 is not available if Exchange Mode is Aggressive. When IKE Version is set to 2, Mode and XAUTH are not available.

Select the local ID type from the drop-down list. Select one of:

Enter the negotiation timeout value. The default is 30 seconds.