FortiOS 5.4 Online Help Link FortiOS 5.2 Online Help Link FortiOS 5.0 Online Help Link FortiOS 4.3 Online Help Link

Home > Online Help

> Chapter 14 - IPsec VPN > Transparent mode VPNs > Configure the VPN peers

Configure the VPN peers

  1. The local VPN peer need to operate in transparent mode.
    To determine if your FortiGate unit is in transparent mode, go to System > Dashboard > Status to the System Information widget. Select [change]. Select transparent for the Operation Mode. Two new fields will appear to enter the Management IP/Netmask, and the Default Gateway.
    In transparent mode, the FortiGate unit is invisible to the network. All of its interfaces are on the same subnet and share the same IP address. You only have to configure a management IP address so that you can make configuration changes.

    The remote VPN peer may operate in NAT mode or transparent mode.
  1. At the local FortiGate unit, define the Phase 1 parameters needed to establish a secure connection with the remote peer. See Phase 1 parameters. Select Advanced and enter these settings in particular:
Remote Gateway Select Static IP Address.
IP Address Type the IP address of the public interface to the remote peer. If the remote peer is a FortiGate unit running in transparent mode, type the IP address of the remote management interface.
Advanced Select Nat-traversal, and type a value into the Keepalive Frequency field. These settings protect the headers of encrypted packets from being altered by external NAT devices and ensure that NAT address mappings do not change while the VPN tunnel is open. For more information, see Phase 1 parameters and Phase 1 parameters.
  1. Define the Phase 2 parameters needed to create a VPN tunnel with the remote peer. See Phase 2 parameters. Select the set of Phase 1 parameters that you defined for the remote peer. The name of the remote peer can be selected from the Static IP Address list.
  2. Define the source and destination addresses of the IP packets that are to be transported through the VPN tunnel. See Defining VPN security policies. Enter these settings in particular:
  • For the originating address (source address), enter the IP address and netmask of the private network behind the local peer network. for the management interface, for example, 10.10.10.0/24. This address needs to be a range to allow traffic from your network through the tunnel. Optionally select any for this address.
  • For the remote address (destination address), enter the IP address and netmask of the private network behind the remote peer (for example, 192.168.10.0/24). If the remote peer is a FortiGate unit running in transparent mode, enter the IP address of the remote management interface instead.
  1. Define an IPsec security policy to permit communications between the source and destination addresses. See Defining VPN security policies. Enter these settings in particular:
Incoming Interface Select the local interface to the internal (private) network.
Source Address Select the source address that you defined in Step 4.
Outgoing Interface Select the interface to the edge router. When you configure the IPsec security policy on a remote peer that operates in NAT mode, you select the public interface to the external (public) network instead.
Destination Address Select the destination address that you defined in Step 4.
VPN Tunnel Select Use Existing and select the name of the Phase 2 tunnel configuration that you created in Step 3 from the drop-down list.

Select Allow traffic to be initiated from the remote site to enable traffic from the remote network to initiate the tunnel.
  1. Place the policy in the policy list above any other policies having similar source and destination addresses.
  2. Define another IPsec security policy to permit communications between the source and destination addresses in the opposite direction. This security policy and the previous one form a bi-directional policy pair. See Defining VPN security policies. Enter these settings in particular:
Incoming Interface Select the interface to the edge router. When you configure the IPsec security policy on a remote peer that operates in NAT mode, you select the public interface to the external (public) network instead.
Source Address Select the destination address that you defined in Step 4..
Outgoing Interface Select the local interface to the internal (private) network.
Destination Address Select the source address that you defined in Step 4.
VPN Tunnel Select Use Existing and select the name of the Phase 2 tunnel configuration that you created in Step 3 from the drop-down list.

Select Allow traffic to be initiated from the remote site to enable traffic from the remote network to initiate the tunnel.
  1. Repeat this procedure at the remote FortiGate unit to create bidirectional security policies. Use the local interface and address information local to the remote FortiGate unit.

For more information on transparent mode, see the System Administration Guide.