Manual and active-passive
You can create manual (peer-to-peer) and active-passive WAN optimization configurations.
There are a few key differences between manual and active-passive mode:
-
For manual mode, the tunnels are always up which makes it more resource extensive as compared to active-passive.
-
The performance of active-passive mode is lower than manual mode for the new connection.
-
The active-passive mode can be used to deploy tunnel dynamically using Authentication groups set to accept Any peers which eliminates the need of defining peers manually. This is not possible with manual mode.
This setting is only recommended when you do not know the peer host IDs or IP addresses of the peers that will use this authentication group. This setting is most often used with FortiGate units that do not have static IP addresses, for example units that use DHCP.
-
For manual mode, traffic shaping cannot be applied to traffic on the server-side. See Traffic shaping for more information.
Manual (peer to peer) configurations
Manual configurations allow for WAN optimization between one client-side FortiGate unit and one server-side FortiGate unit. Manual WAN optimization requires a manual WAN optimization firewall policy on the client-side FortiGate unit and a WAN optimization proxy policy on the server-side FortiGate unit.
In a manual mode configuration, the client-side peer can only connect to the named server side peer. When the client-side peer initiates a tunnel with the server-side peer, the packets that initiate the tunnel include extra information so that the server-side peer can determine that it is a peer-to-peer tunnel request. This extra information is required because the server-side peer does not require a WAN optimization firewall policy; however, you need to add the client peer host ID and IP address to the server-side FortiGate unit peer list. See Manual (peer-to-peer) WAN optimization configuration example for a sample configuration.
Active-passive configurations
Active-passive WAN optimization requires an active WAN optimization firewall policy on the client-side FortiGate unit and a passive WAN optimization firewall policy on the server-side FortiGate unit. The server-side FortiGate unit also requires a WAN optimization proxy policy.
You can use the passive policy to control WAN optimization address translation by specifying transparent mode or non-transparent mode. You can also use the passive policy to apply security profiles, web caching, and other FortiGate features at the server-side FortiGate unit. For example, if a server-side FortiGate unit is protecting a web server, the passive policy could enable web caching.
A single passive policy can accept tunnel requests from multiple FortiGate units as long as the server-side FortiGate unit includes their peer IDs and all of the client-side FortiGate units include the server-side peer ID. See Active-passive WAN optimization configuration example for a sample configuration.
|
|
The WAN optimization proxy policy can only be added from the CLI and policies with |