VPN security policies
This section explains how to specify the source and destination IP addresses of traffic transmitted through an IPsec VPN, and how to define appropriate security policies.
Topology
Defining policy addresses
In a gateway-to-gateway, hub-and-spoke, dynamic DNS, redundant tunnel, or transparent configuration, you need to define a policy address for the private IP address of the network behind the remote VPN peer (for example, 192.168.10.0/255.255.255.0 or 192.168.10.0/24).
In a peer-to-peer configuration, you need to define a policy address for the private IP address of a server or host behind the remote VPN peer (for example, 172.16.5.1/255.255.255.255, 172.16.5.1/32, or 172.16.5.1).
For a FortiGate dialup server in a dialup-client or internet-browsing configuration, the source IP should reflect the IP addresses of the dialup clients:
Defining security policies
Policy-based and route-based VPNs require different security policies.
- A policy-based VPN requires an IPsec policy. You specify the interface to the private network, the interface to the remote peer and the VPN tunnel. A single policy can enable traffic inbound, outbound, or in both directions.
- A route-based VPN requires an accept policy for each direction. For the source and destination interfaces, you specify the interface to the private network and the virtual IPsec interface (phase 1 configuration) of the VPN. The IPsec interface is the destination interface for the outbound policy and the source interface for the inbound policy. One security policy must be configured for each direction of each VPN interface.
|
If the policy that grants the VPN connection is limited to certain services, DHCP must be included, otherwise the client will not be able to retrieve a lease from the FortiGate’s (IPsec) DHCP server because the DHCP request (coming out of the tunnel) will be blocked. |
Policy-based VPN
An IPsec policy enables the transmission and reception of encrypted packets, specifies the permitted direction of VPN traffic, and selects the VPN tunnel. In most cases, a single policy is needed to control both inbound and outbound IP traffic through a VPN tunnel. For a detailed example, see Policy-based IPsec tunnel. Be aware of the following before creating an IPsec policy.
Allow traffic to be initiated from the remote site
Policies specify which IP addresses can initiate a tunnel. By default, traffic from the local private network initiates the tunnel. When the Allow traffic to be initiated form the remote site option is selected, traffic from a dialup client, or a computer on a remote network, initiates the tunnel. Both can be enabled at the same time for bi-directional initiation of the tunnel.
Outbound and inbound NAT
When a FortiGate operates in NAT mode, you can enable inbound or outbound NAT. Outbound NAT may be performed on outbound encrypted packets or IP packets in order to change their source address before they are sent through the tunnel. Inbound NAT is performed to intercept and decrypt emerging IP packets from the tunnel.
By default, these options are not selected in security policies and can only be set through the CLI.
Defining multiple IPsec policies for the same tunnel
You must define at least one IPsec policy for each VPN tunnel. If the same remote server or client requires access to more than one network behind a local FortiGate, the FortiGate must be configured with an IPsec policy for each network. Multiple policies may be required to configure redundant connections to a remote destination or control access to different services at different times.
To ensure a secure connection, the FortiGate must evaluate policies with Action set to IPsec before ACCEPT and DENY. Because the FortiGate unit reads policies starting at the top of the list, you must move all IPsec policies to the top of the list, and be sure to reorder your multiple IPsec policies that apply to the tunnel so that specific constraints can be evaluated before general constraints. If you create two equivalent IPsec policies for two different tunnels, the system will select the correct policy based on the specified source and destination addresses.
|
|
Adding multiple IPsec policies for the same VPN tunnel can cause conflicts if the policies specify similar source and destination addresses, but have different settings for the same service. When policies overlap in this manner, the system may apply the wrong IPsec policy or the tunnel may fail. |
Route-based VPN
When you define a route-based VPN, you create a virtual IPsec interface on the physical interface that connects to the remote peer. You create ordinary accept policies to enable traffic between the IPsec interface and the interface that connects to the private network. This makes configuration simpler than for policy-based VPNs.
To configure policies for a route-based VPN:
- Go to Policy & Objects > Firewall Policy.
- Click Create New and define an ACCEPT policy to permit communication between the local private network and the private network behind the remote peer and enter these settings in particular:
Name
Enter a name for the security policy.
Incoming Interface
Select the interface that connects to the private network behind this FortiGate.
Outgoing Interface
Select the IPsec interface you configured.
Source
Select the address name you defined for the private network behind this FortiGate.
Destination
Select the address name you defined for the private network behind the remote peer.
Action
Select ACCEPT.
NAT
Disable NAT.
- Click OK.
To permit the remote client to initiate communication, you need to define a security policy for communication in that direction.
- Click Create New and enter these settings in particular:
Name
Enter a name for the security policy.
Incoming Interface
Select the IPsec interface you configured.
Outgoing Interface
Select the interface that connects to the private network behind this FortiGate.
Source
Select the address name you defined for the private network behind the remote peer.
Destination
Select the address name you defined for the private network behind this FortiGate.
Action
Select ACCEPT.
NAT
Disable NAT.
- Click OK.