Fortinet black logo

Cookbook

Network topologies

Copy Link
Copy Doc ID 5ede200c-a21f-11eb-b70b-00505692583a:402352
Download PDF

Network topologies

The topology of your network will determine how remote peers and clients connect to the VPN and how VPN traffic is routed.

Topology

Description

Site-to-Site

Standard one-to-one VPN between two FortiGates. See Site-to-site VPN.

Hub and spoke/ADVPN

One central FortiGate (hub) has multiple VPNs to other remote FortiGates (spokes). In ADVPN, shortcuts can be created between spokes for direct communication. See ADVPN.

OCVPN

Fortinet's cloud based solution for automating VPN setup between devices registered to the same account. See Overlay Controller VPN (OCVPN).

FortiClient dialup

Typically remote FortiClient dialup clients use dynamic IP addresses through NAT devices. The FortiGate acts as a dialup server allowing dialup VPN connections from multiple sources. See FortiClient as dialup client.

FortiGate dialup

Similar to site-to-site except one end is a dialup server and the other end is a dialup client. This facilitates scenarios in which the remote dialup end has a dynamic address, or does not have a public IP, possibly because it is behind NAT. See FortiGate as dialup client.

Aggregate VPN

Natively support aggregating multiple VPN tunnels to increase performance and provide redundancy over multiple links. SeeIPsec aggregate for redundancy and traffic load-balancing.

Redundant VPN

Options for supporting redundant and partially redundant IPsec VPNs, using route-based approaches. See Redundant hub and spoke VPN.

L2TP over IPsec

Configure VPN for Microsoft Windows dialup clients using the built in L2TP software. Users do not have to install any Fortinet software. See L2TP over IPsec.

GRE over IPsec

Legacy support for routers requiring point-to-point GRE over IPsec for tunneling. See GRE over IPsec.

Network topologies

The topology of your network will determine how remote peers and clients connect to the VPN and how VPN traffic is routed.

Topology

Description

Site-to-Site

Standard one-to-one VPN between two FortiGates. See Site-to-site VPN.

Hub and spoke/ADVPN

One central FortiGate (hub) has multiple VPNs to other remote FortiGates (spokes). In ADVPN, shortcuts can be created between spokes for direct communication. See ADVPN.

OCVPN

Fortinet's cloud based solution for automating VPN setup between devices registered to the same account. See Overlay Controller VPN (OCVPN).

FortiClient dialup

Typically remote FortiClient dialup clients use dynamic IP addresses through NAT devices. The FortiGate acts as a dialup server allowing dialup VPN connections from multiple sources. See FortiClient as dialup client.

FortiGate dialup

Similar to site-to-site except one end is a dialup server and the other end is a dialup client. This facilitates scenarios in which the remote dialup end has a dynamic address, or does not have a public IP, possibly because it is behind NAT. See FortiGate as dialup client.

Aggregate VPN

Natively support aggregating multiple VPN tunnels to increase performance and provide redundancy over multiple links. SeeIPsec aggregate for redundancy and traffic load-balancing.

Redundant VPN

Options for supporting redundant and partially redundant IPsec VPNs, using route-based approaches. See Redundant hub and spoke VPN.

L2TP over IPsec

Configure VPN for Microsoft Windows dialup clients using the built in L2TP software. Users do not have to install any Fortinet software. See L2TP over IPsec.

GRE over IPsec

Legacy support for routers requiring point-to-point GRE over IPsec for tunneling. See GRE over IPsec.