Network topologies
The topology of your network will determine how remote peers and clients connect to the VPN and how VPN traffic is routed.
|
Topology |
Description |
|---|---|
|
Site-to-Site |
Standard one-to-one VPN between two FortiGates. See Site-to-site VPN. |
|
Hub and spoke/ADVPN |
One central FortiGate (hub) has multiple VPNs to other remote FortiGates (spokes). In ADVPN, shortcuts can be created between spokes for direct communication. See ADVPN. |
|
OCVPN |
Fortinet's cloud based solution for automating VPN setup between devices registered to the same account. See Overlay Controller VPN (OCVPN). |
|
FortiClient dialup |
Typically remote FortiClient dialup clients use dynamic IP addresses through NAT devices. The FortiGate acts as a dialup server allowing dialup VPN connections from multiple sources. See FortiClient as dialup client. |
|
FortiGate dialup |
Similar to site-to-site except one end is a dialup server and the other end is a dialup client. This facilitates scenarios in which the remote dialup end has a dynamic address, or does not have a public IP, possibly because it is behind NAT. See FortiGate as dialup client. |
|
Aggregate VPN |
Natively support aggregating multiple VPN tunnels to increase performance and provide redundancy over multiple links. See Packet distribution and redundancy for aggregate IPsec tunnels. |
|
Redundant VPN |
Options for supporting redundant and partially redundant IPsec VPNs, using route-based approaches. See Redundant hub and spoke VPN. |
|
L2TP over IPsec |
Configure VPN for Microsoft Windows dialup clients using the built in L2TP software. Users do not have to install any Fortinet software. See L2TP over IPsec. |
|
GRE over IPsec |
Legacy support for routers requiring point-to-point GRE over IPsec for tunneling. See GRE over IPsec. |