Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • FortiGate-6000 Release Notes

    Home FortiGate-6000 6.0.17 FortiGate-6000 Release Notes
    6.0.17
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.10
    7.0.5
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.10
    6.4.8
    6.4.6
    6.4.2
    6.2.16
    6.2.15
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.7
    6.2.6
    6.2.4
    6.2.3
    6.0.18
    6.0.17
    6.0.16
    6.0.15
    6.0.14
    6.0.13
    6.0.12
    6.0.10
    6.0.9
    6.0.8
    6.0.6
    6.0.4
    5.6.14
    5.6.12
    5.6.11
    5.6.7
    5.6.6
    5.4.10
    5.4.9

    IPsec VPN feature notes

    IPsec VPN feature notes

    This section contains notes and limitations for FortiGate-6000 and 7000 IPsec VPNs for FortiOS 6.0.17.

    FortiGate-6000 and FortiGate-7000 IPsec VPN

    The following notes and limitations apply to both FortiGate-6000 and 7000 IPsec VPNs for FortiOS 6.0.17:

    • Site-to-Site IPsec VPN is supported.
    • Dialup IPsec VPN is supported. The FortiGate-6000 or 7000 can be the dialup server or client.
    • Interface-based IPsec VPN (also called route-based IPsec VPN) is supported. Policy-based IPsec VPN is not supported.
    • Static routes can point at IPsec VPN interfaces and can be used for routing the traffic inside IPsec VPN tunnels.
    • Policy routes cannot be used for communication over IPsec VPN tunnels.
    • VRF routes cannot be used for communication over IPsec VPN tunnels.
    • Remote networks with 0- to 15-bit netmasks are not supported. Remote networks with 16- to 32-bit netmasks are supported.
    • IPv6 clear-text traffic (IPv6 over IPv4 or IPv6 over IPv6) is not supported.
    • IPsec SA synchronization between HA peers is not supported. After an HA failover, IPsec VPN tunnels have to be re-initialized.

    FortiGate-6000 IPsec VPN

    The following notes and limitations apply to FortiGate-6000 IPsec VPNs for FortiOS 6.0.17:

    • The FortiGate-6000 supports load balancing IPsec VPN tunnels to multiple FPCs as long as only static routes are used over the IPsec VPN tunnels.
    • If FortiGate-6000 IPsec VPN load balancing is not enabled, you can use static or dynamic routing (RIP, OSPF, BGP) over IPsec VPN tunnels.
    • With FortiGate-6000 IPsec VPN load balancing enabled, the FortiGate-6000 DP3 processor terminates individual IPsec VPN tunnels on different FPCs. All traffic to and from a specific tunnel is processed by the same FPC. Individual tunnel SAs are not synchronized to other FPCs. One result of this setup is that traffic cannot travel between two tunnels since the two tunnels could be terminated on different FPCs. With IPsec load balancing enabled, traffic cannot travel between two IPsec VPN tunnels.
    • Traffic between two IPsec VPN tunnels is supported if load balancing is disabled. In this case, all IPsec VPN tunnels are terminated on the primary FPC and traffic between IPsec VPN tunnels is supported.

    FortiGate-7000 IPsec VPN

    The following notes and limitations apply to FortiGate-7000 IPsec VPNs for FortiOS 6.0.17:

    • Dynamic routing (RIP, OSPF, BGP) over IPsec VPN tunnels is supported.
    • The FortiGate-7000 does not support load-balancing IPsec VPN tunnels to multiple FPMs. All IPsec VPN tunnels are terminated on the primary FPM and traffic between IPsec VPN tunnels is supported.
    Previous
    Next

    IPsec VPN feature notes

    IPsec VPN feature notes

    This section contains notes and limitations for FortiGate-6000 and 7000 IPsec VPNs for FortiOS 6.0.17.

    FortiGate-6000 and FortiGate-7000 IPsec VPN

    The following notes and limitations apply to both FortiGate-6000 and 7000 IPsec VPNs for FortiOS 6.0.17:

    • Site-to-Site IPsec VPN is supported.
    • Dialup IPsec VPN is supported. The FortiGate-6000 or 7000 can be the dialup server or client.
    • Interface-based IPsec VPN (also called route-based IPsec VPN) is supported. Policy-based IPsec VPN is not supported.
    • Static routes can point at IPsec VPN interfaces and can be used for routing the traffic inside IPsec VPN tunnels.
    • Policy routes cannot be used for communication over IPsec VPN tunnels.
    • VRF routes cannot be used for communication over IPsec VPN tunnels.
    • Remote networks with 0- to 15-bit netmasks are not supported. Remote networks with 16- to 32-bit netmasks are supported.
    • IPv6 clear-text traffic (IPv6 over IPv4 or IPv6 over IPv6) is not supported.
    • IPsec SA synchronization between HA peers is not supported. After an HA failover, IPsec VPN tunnels have to be re-initialized.

    FortiGate-6000 IPsec VPN

    The following notes and limitations apply to FortiGate-6000 IPsec VPNs for FortiOS 6.0.17:

    • The FortiGate-6000 supports load balancing IPsec VPN tunnels to multiple FPCs as long as only static routes are used over the IPsec VPN tunnels.
    • If FortiGate-6000 IPsec VPN load balancing is not enabled, you can use static or dynamic routing (RIP, OSPF, BGP) over IPsec VPN tunnels.
    • With FortiGate-6000 IPsec VPN load balancing enabled, the FortiGate-6000 DP3 processor terminates individual IPsec VPN tunnels on different FPCs. All traffic to and from a specific tunnel is processed by the same FPC. Individual tunnel SAs are not synchronized to other FPCs. One result of this setup is that traffic cannot travel between two tunnels since the two tunnels could be terminated on different FPCs. With IPsec load balancing enabled, traffic cannot travel between two IPsec VPN tunnels.
    • Traffic between two IPsec VPN tunnels is supported if load balancing is disabled. In this case, all IPsec VPN tunnels are terminated on the primary FPC and traffic between IPsec VPN tunnels is supported.

    FortiGate-7000 IPsec VPN

    The following notes and limitations apply to FortiGate-7000 IPsec VPNs for FortiOS 6.0.17:

    • Dynamic routing (RIP, OSPF, BGP) over IPsec VPN tunnels is supported.
    • The FortiGate-7000 does not support load-balancing IPsec VPN tunnels to multiple FPMs. All IPsec VPN tunnels are terminated on the primary FPM and traffic between IPsec VPN tunnels is supported.
    Previous
    Next