VPN Gateways

FortiManager and IPsec Configuration

• During phase 2 negotiation, the protected network can be used by FortiManager for negotiating the local subnet.
• When configuring a managed gateway, the device to be selected is the FortiManager.
• The interface to be selected as the default VPN interface for terminating the IPsec tunnel is the one specified as the Local Gateway IP address.
• Specifying the Local Gateway IP address is necessary when an interface has multiple IP addresses assigned, to determine the correct IP address for IPsec negotiation.
• In advanced settings for IPsec, settings such as encryption algorithms, authentication methods, and key exchange protocols can be configured.
• Normalised IPsec interface configuration is required for SD-WAN member configuration.
• When using per-platform mapping, VPN configuration must be installed first.
• When using per-device mapping, VPN configuration does not need to be installed first.
• Normalised interfaces are required for configuring an IPsec interface as an SD-WAN member.
• Firewall policies for SD-WAN must reference the IPsec interface.

Gateway Configuration

• Manual VPN configuration application is required by the administrator for external gateways.
• The two types of gateways mentioned are managed gateways and external gateways.
• Settings required for managed gateway configuration include IPsec settings, VPN configuration, and interface configuration.
• FortiManager can push settings to managed gateways during installation.
• The role required for star or dial-up topologies is a hub.
• The interface used as the default VPN interface for tunnel termination is the one specified as the Local Gateway IP address.
• The purpose of advanced settings in managed gateway configuration is to customize IPsec settings.
• When creating a new managed gateway, FortiManager displays the gateway configuration settings.
• The remote protected subnets for a managed gateway are determined by the gateway's configuration.
• The purpose of external gateways is to provide VPN connectivity to remote sites or networks.