Select either HUB or Spoke from the drop-down list.

Note: This menu item is available when Topology is Star or Dial up.

Enter the gateway name.

Select the gateway IP address from the drop-down list.

Select the hub IP address from the drop-down list.

Note: This menu item is available when Topology is Star or Dial up and Node Type is HUB.

Select the checkbox to create a phase2 per protected subnet pair.

Select the peer type. Select one of the following:

A Local ID is an alphanumeric value assigned in the Phase 1 configuration. The Local ID of a peer is called a Peer ID.

The Local ID or peer ID can be used to uniquely identify one end of a VPN tunnel. This enables a more secure connection. Also if you have multiple VPN tunnels negotiating, this ensures the proper remote and local ends connect. When you configure it on your end, it is your Local ID. When the remote end connects to you, they see it as your peer ID.

If you are debugging a VPN connection, the Local ID is part of the VPN negotiations. You can use it to help troubleshoot connection problems.

The default configuration is to accept all local IDs (peer IDs). If you have the Local ID set, the remote end of the tunnel must be configured to accept your Local ID.

Note: This menu item is available when Topology is Dial up.

Select the address or address group from the drop-down list and select the plus (+) icon to add the entry. You can add multiple entries.

Enter the local gateway in the text field.

Select either HUB or Spoke from the drop-down list.

Note: This menu item is available when Topology is Star or Dial up.

Select the device from the drop-down list.

Select the default VPN interface from the drop-down list.

Select the hub-to-hub interface from the drop-down list. This field is mandatory for multiple hubs.

Note: This menu item is available when Topology is Star or Dial up and Node Type is HUB.

Select the peer type. Select one of the following:

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Select either Manual (via Device Manager) or Automatic.

Select the address or address group from the drop-down list, select the priority and select the plus (+) icon to add the entry. You can add multiple entries.

Note: This menu item is available when Topology is Star or Dial up and Node Type is HUB.

Select the address or address group from the drop-down list and select the plus (+) icon to add the entry. You can add multiple entries.

Select to enable IKE Configuration Method.

Note: This menu item is available when Topology is Dial up.

Select to enable IP assignment.

Note: This menu item is available when Topology is Dial up.

Select either Range or User Group from the drop-down list.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Select either IP or Subnet from the drop-down list.

Note: This menu item is available when Topology is Dial up, Node Type is HUB, and IP Assignment Mode is Range

Enter the IPv4 start IP address.

Note: This menu item is available when Topology is Dial up, Node Type is HUB, and IP Assignment Mode is Range

Enter the IPv4 end IP address.

Note: This menu item is available when Topology is Dial up, Node Type is HUB, and IP Assignment Mode is Range

Enter the IPv4 network mask.

Note: This menu item is available when Topology is Dial up, Node Type is HUB, and IP Assignment Mode is Range.

Select the checkbox to add a route for this entry.

Enter the DNS server IP address to provide IKE Configuration Method to clients.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Enter the DNS server IP address to provide IKE Configuration Method to clients.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Enter the DNS server IP address to provide IKE Configuration Method to clients.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Enter the WINS server IP address to provide IKE Configuration Method to clients.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Enter the WINS server IP address to provide IKE Configuration Method to clients.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Select the address or address group from the drop-down list.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

Enter the local gateway in the text field.

Enter the start IP and end IP and select the plus (+) icon to add the entry. You can add multiple entries.

Note: This menu item is available when Topology is Dial up and Node Type is HUB.

For more information on advanced option, see the FortiOS 5.0 CLI Reference.

Enter the XAuth client password for the FortiGate.

Note: This field is available when xauthtype is set to client.

Enter the XAuth client user name for the FortiGate.

Note: This field is available when xauthtype is set to client.

Select the authentication user group from the drop-down list.

Note: This field is available when xauthtype is set to auto, pap, or chap.

When the FortiGate unit is configured as an XAuth server, enter the user group to authenticate remote VPN peers. The user group can contain local users, LDAP servers, and RADIUS servers. The user group must be added to the FortiGate configuration before the group name can be cross referenced.

Enter the banner value.

Specify a message to send to IKE Configuration Method clients. Some clients display this message to users. This is available if mode-cfg (IKE Configuration Method) is enabled.

Select either manual or auto from the drop-down list.

Enter the domain value.

Enter the public IP value.

Use this field to configure a VPN with dynamic interfaces. Define a public-ip value here, which is the dynamically assigned PPPoE address, which remains static and does not change over time. See “VPN Console supports NAT device with a public IP feature” for more information.

Select either enable or disable from the drop-down list.

Select the XAuth type from the drop-down list. Select one of: disable, client, pap, chap, or auto.