Fortinet fortigate-100a Betriebsanweisung
VPN
Setting the destination address for encrypted traffic
FortiGate-100A Administration Guide
01-28006-0068-20041105
281
Setting the destination address for encrypted traffic
The destination address determines which remote peers and clients will be allowed to
access the specified source address. In general:
access the specified source address. In general:
• For a gateway-to-gateway VPN, the destination address is the static private
address space assigned to the network behind the remote peer.
• For a peer-to-peer VPN, the destination address is the static public IP address of
the remote peer.
• For remote-client configurations, the destination address is the IP address of the
remote client. If the remote client acquires a virtual IP address or a dynamic IP
address, the destination address that you specify must match the virtual or
dynamic IP address that the remote client can acquire.
address, the destination address that you specify must match the virtual or
dynamic IP address that the remote client can acquire.
To add a destination address, see
.
Adding an IPSec firewall encryption policy
Use the following procedure to add an IPSec firewall encryption policy.
To define the firewall encryption policy
1
Go to Firewall > Address > Address.
2
Set the encryption policy direction. See
3
Add the source and destination addresses. See
4
Set Action to ENCRYPT.
5
From the VPN tunnel list, select a phase 2 tunnel configuration.
6
Configure the following options if required:
7
Select additional options if required to apply a protection profile and/or other firewall
policy features.
policy features.
8
Select OK.
Internet browsing through a VPN tunnel
Using Internet browsing through a VPN tunnel, remote VPN users can connect to a
network behind a FortiGate unit or browse the Internet using the same VPN tunnel.
Firewall policies can apply virus scanning, web filtering, and other FortiGate features
to remote VPN traffic that connects to the Internet. Applying virus scanning and other
FortiGate features to remote VPN user Internet connections enhances the security of
remote VPN user traffic and protects remote VPN users from viruses and other threats
on the Internet. Also, if all remote VPN Internet traffic is sent over the VPN, the remote
client does not send any unencrypted traffic to the Internet.
network behind a FortiGate unit or browse the Internet using the same VPN tunnel.
Firewall policies can apply virus scanning, web filtering, and other FortiGate features
to remote VPN traffic that connects to the Internet. Applying virus scanning and other
FortiGate features to remote VPN user Internet connections enhances the security of
remote VPN user traffic and protects remote VPN users from viruses and other threats
on the Internet. Also, if all remote VPN Internet traffic is sent over the VPN, the remote
client does not send any unencrypted traffic to the Internet.
Internet browsing through a VPN tunnel is supported between VPN peers or for a
remote VPN client. Internet browsing through a VPN tunnel is available for static IP
VPNs, dynamic DNS VPNs, and dialup VPNs.
remote VPN client. Internet browsing through a VPN tunnel is available for static IP
VPNs, dynamic DNS VPNs, and dialup VPNs.