DOCUMENT LIBRARY

Administration Guide

Getting started
- Summary of steps
- Using the GUI
- Using the CLI
- Configuration and management
- Product registration with FortiCare
- FortiGate models
Dashboards and Monitors
- Using dashboards
- Using widgets
- Viewing device dashboards in the Security Fabric
- Creating a fabric system and license dashboard
- Dashboards
- Monitors
Network
- Interfaces
  - Interface settings
  - Physical interface
  - VLAN
  - Aggregation and redundancy
  - Loopback interface
  - Software switch
  - Hardware switch
  - Zone
  - Virtual wire pair
    - PRP handling in NAT mode with virtual wire pair
    - Using VLAN sub-interfaces in virtual wire pairs
  - Enhanced MAC VLAN
  - VXLAN
- DNS
  - Important DNS CLI commands
  - DNS domain list
  - FortiGate DNS server
    - Basic DNS server configuration example
  - DDNS
  - DNS latency information
  - DNS over TLS and HTTPS
  - Transparent conditional DNS forwarder
  - Interfaces in non-management VDOMs as the source IP address of the DNS conditional forwarding server
  - DNS session helpers
  - DNS troubleshooting
- Explicit and transparent proxies
  - Explicit web proxy
  - FTP proxy
  - Transparent proxy
  - Proxy policy addresses
  - Proxy policy security profiles
  - Explicit proxy authentication
  - Transparent web proxy forwarding
  - Transparent web proxy forwarding over IPv6
  - Upstream proxy authentication in transparent proxy mode
  - Multiple dynamic header count
  - Restricted SaaS access
  - Explicit proxy and FortiGate Cloud Sandbox
  - Proxy chaining
  - WAN optimization SSL proxy chaining
  - Agentless NTLM authentication for web proxy
  - Multiple LDAP servers in Kerberos keytabs and agentless NTLM domain controllers
  - Learn client IP addresses
  - Explicit proxy authentication over HTTPS
  - mTLS client certificate authentication
  - CORS protocol in explicit web proxy when using session-based, cookie-enabled, and captive portal-enabled SAML authentication
  - Display CORS content in an explicit proxy environment
  - HTTP connection coalescing and concurrent multiplexing for explicit proxy
  - Secure explicit proxy
  - Secure explicit proxy with client certificates
  - Explicit proxy logging
  - Configuring fast fallback for explicit proxy
  - Forward HTTPS requests to a web server without the need for an HTTP CONNECT message
- DHCP servers and relays
  - Basic configuration
  - DHCP options
  - DHCP addressing mode on an interface
  - VCI pattern matching for DHCP assignment
  - DHCP shared subnet
  - Multiple DHCP relay servers
  - DHCP smart relay on interfaces with a secondary IP
  - FortiGate DHCP works with DDNS to allow FQDN connectivity to leased IP addresses
- Static routing
  - Routing concepts
  - Policy routes
  - Equal cost multi-path
  - Dual internet connections
- Dynamic routing
  - RIP
    - Basic RIP example
    - Basic RIPng example
  - OSPF
  - BGP
  - BFD
    - BFD for multihop path for BGP
  - Routing objects
- Multicast
  - Multicast routing and PIM support
  - Configuring multicast forwarding
  - Using IPS inspection for multicast UDP traffic
- FortiExtender
  - Adding a FortiExtender
- Direct IP support for LTE/4G
- Cellular interface support for IPv6
- Active SIM card switching
- Airplane mode and LTE/BLE
- Upgrade LTE modem firmware directly from FortiGuard
- LLDP reception
- Virtual routing and forwarding
  - Implementing VRF
  - VRF routing support
  - Route leaking between VRFs with BGP
  - Route leaking between multiple VRFs
  - VRF with IPv6
  - IBGP and EBGP support in VRF
  - Support cross-VRF local-in and local-out traffic for local services
- NetFlow
  - NetFlow templates
  - NetFlow on FortiExtender and tunnel interfaces
  - Allow multiple Netflow collectors
- sFlow
- Link monitor
  - Link monitor with route updates
  - Enable or disable updating policy routes when link health monitor fails
  - Add weight setting on each link health monitor server
  - SLA link monitoring for dynamic IPsec and SSL VPN tunnels
- IPv6
  - IPv6 overview
  - IPv6 quick start
  - Neighbor discovery proxy
  - IPv6 address assignment
  - NAT66, NAT46, NAT64, and DNS64
  - DHCPv6 relay
  - IPv6 tunneling
  - IPv6 Simple Network Management Protocol
  - Dynamic routing in IPv6
    - OSPFv3 and IPv6
    - BGP and IPv6
  - IPv6 configuration examples
- FortiGate LAN extension
  - Example CLI configuration
  - Example GUI configuration
  - DHCP client mode for inter-VDOM links
  - FortiGate secure edge to FortiSASE
  - WiFi access point with internet connectivity
- SCTP packets with zero checksum on the NP7 platform
- Industrial Connectivity
- Diagnostics
  - Using the packet capture tool
  - Using the debug flow tool
SD-WAN
- SD-WAN overview
  - SD-WAN components and design principles
  - SD-WAN designs and architectures
- SD-WAN quick start
- SD-WAN members and zones
  - Specify an SD-WAN zone in static routes and SD-WAN rules
  - Defining a preferred source IP for local-out egress interfaces on SD-WAN members
- Performance SLA
- SD-WAN rules
- Advanced routing
- VPN overlay
- Advanced configuration
- SD-WAN cloud on-ramp
- SD-WAN Network Monitor service
- Troubleshooting SD-WAN
Zero Trust Network Access
- Zero Trust Network Access introduction
- ZTNA advanced configurations
- ZTNA configuration examples
- ZTNA troubleshooting and debugging commands
- ZTNA troubleshooting scenarios
Policy and Objects
- Policies
- Address objects
- Protocol options
  - Stripping the X-Forwarded-For value in the HTTP header
- Traffic shaping
- Internet Services
Security Profiles
- Inspection modes
  - Flow mode inspection (default mode)
  - Proxy mode inspection
  - Inspection mode feature comparison
- Antivirus
  - Antivirus introduction
  - Advanced configurations
  - Configuration examples
- Web filter
  - Web filter introduction
  - Advanced CLI configuration
  - Configuration examples
    - Configuring web filter profiles with Hebrew domain names
    - Configuring web filter profiles to block AI and cryptocurrency
- Video filter
  - Filtering based on FortiGuard categories
  - Filtering based on YouTube channel
  - Filtering based on title
  - Filtering based on description
  - Configuring a video filter keyword list
  - Replacement messages displayed in blocked videos
- DNS filter
  - Configuring a DNS filter profile
  - FortiGuard category-based DNS domain filtering
  - Botnet C&C domain blocking
  - DNS safe search
  - Local domain filter
  - DNS translation
  - Applying DNS filter to FortiGate DNS server
  - DNS inspection with DoT and DoH
  - DNS over QUIC and DNS over HTTP3 for transparent and local-in DNS modes
  - Troubleshooting for DNS filter
- Application control
  - Configuring an application sensor
  - Basic category filters and overrides
  - Excluding signatures in application control profiles
  - Port enforcement check
  - Protocol enforcement
  - SSL-based application detection over decrypted traffic in a sandwich topology
  - Matching multiple parameters on application control signatures
  - Application signature dissector for DNP3
- Inline CASB
  - Inline CASB examples
- Intrusion prevention
  - Signature-based defense
  - Configuring an IPS sensor
  - IPS configuration options
  - SCTP filtering capabilities
  - Diameter protocol inspection
  - IPS signature filter options
  - IPS with botnet C&C IP blocking
  - IPS signatures for the operational technology security service
  - IPS sensor for IEC 61850 MMS protocol
- File filter
  - Supported file types
- Email filter
  - Configuring an email filter profile
  - Local-based filters
  - FortiGuard-based filters
  - Third-party-based filters
  - Filtering order
  - Protocols and actions
  - Configuring webmail filtering
- VoIP solutions
  - General use cases
  - NAT46 and NAT64 for SIP ALG
  - SIP message inspection and filtering
  - SIP ALG and SIP session helper
  - SIP pinholes
  - SIP over TLS
  - Voice VLAN auto-assignment
  - Scanning MSRP traffic
- ICAP
  - ICAP configuration example
  - ICAP response filtering
  - Secure ICAP clients
  - ICAP scanning with SCP and FTP
  - Domain name in XFF with ICAP
- Web application firewall
  - Protecting a server running web applications
- Data loss prevention
  - DLP techniques
  - Basic DLP settings
  - Advanced DLP configurations
  - DLP fingerprinting
  - FortiGuard DLP service
  - Sensitivity labels
  - Exact data matching
  - DLP examples
- Virtual patching
  - OT virtual patching basic examples
  - OT and IoT virtual patching on NAC policies
- SSL & SSH Inspection
  - Configuring an SSL/SSH inspection profile
  - Certificate inspection
  - Deep inspection
  - Protecting an SSL server
  - Handling SSL offloaded traffic from an external decryption device
  - SSH traffic file scanning
  - Redirect to WAD after handshake completion
  - HTTP/2 support in proxy mode SSL inspection
  - Define multiple certificates in an SSL profile in replace mode
  - Disabling the FortiGuard IP address rating
  - Block or allow ECH TLS connections
- Custom signatures
  - Configuring custom signatures
  - Blocking applications with custom signatures
  - Filters for application control groups
  - Application groups in traffic shaping policies
- Overrides
  - Web rating override
  - Using local and remote categories
  - Web profile override
- IP ban
  - IP ban using the CLI
  - IP ban using security profiles
  - Configuring the persistency for a banned IP list
- Profile groups
IPsec VPN
- General IPsec VPN configuration
- Site-to-site VPN
  - FortiGate-to-FortiGate
  - FortiGate-to-third-party
- Remote access
- Aggregate and redundant VPN
- ADVPN
- Fabric Overlay Orchestrator
- Other VPN topics
- VPN IPsec troubleshooting
  - Understanding VPN related logs
  - IPsec related diagnose commands
SSL VPN
- SSL VPN to dial-up VPN migration
- SSL VPN best practices
- SSL VPN security best practices
- SSL VPN quick start
- SSL VPN tunnel mode
- SSL VPN web mode
- SSL VPN authentication
- SSL VPN to IPsec VPN
- SSL VPN protocols
- Configuring OS and host check
- FortiGate as SSL VPN Client
- Dual stack IPv4 and IPv6 support for SSL VPN
- Disable the clipboard in SSL VPN web mode RDP connections
- SSL VPN IP address assignments
- Using SSL VPN interfaces in zones
- SSL VPN troubleshooting
  - Debug commands
  - Troubleshooting common issues
User & Authentication
- User definition, groups, and settings
- Basic authentication with cached client certificates
- LDAP servers
- RADIUS servers
- SAML
- TACACS+ servers
- FortiTokens
- PKI
  - Configuring a PKI user
  - Using the SAN field for LDAP-integrated certificate authentication
- FSSO
- Include usernames in logs
Wireless configuration
Switch Controller
System
- Administrators
  - Local authentication
  - Remote authentication for administrators
  - Administrator account options
  - REST API administrator
  - SSO administrators
  - FortiCloud SSO
  - Allowing the FortiGate to override FortiCloud SSO administrator user permissions
  - Password policy
  - Public key SSH access
  - Separating the SSHD host key from the administration server certificate
  - Restricting SSH and Telnet jump host capabilities
  - Remote administrators with TACACS+ VSA attributes
- Administrator profiles
- Firmware & Registration
  - About firmware installations
  - Firmware labels
  - Upgrading individual devices
  - Upgrading Fabric or managed devices
  - Enabling automatic firmware upgrades
  - One-time upgrade prompt when a critical vulnerability is detected upon login
  - Authorizing devices
  - Firmware upgrade notifications
  - Downloading a firmware image
  - Testing a firmware version
  - Installing firmware from system reboot
  - Restoring from a USB drive
  - Using controlled upgrades
  - Downgrading individual device firmware
  - Downloading the EOS support package for supported Fabric devices
  - How the FortiGate firmware license works
- Settings
  - Default administrator password
  - Changing the host name
  - Setting the system time
    - SHA-1 authentication support (for NTPv4)
    - PTPv2
  - Configuring ports
    - Custom default service port range
  - Setting the idle timeout time
  - Setting the password policy
  - Changing the view settings
  - Setting the administrator password retries and lockout time
  - TLS configuration
  - Controlling return path with auxiliary session
  - Email alerts
  - Using configuration save mode
  - Trusted platform module support
  - Using the default certificate for HTTPS administrative access
  - Configure TCP NPU session delay globally NEW
- Virtual Domains
  - VDOM overview
  - General configurations
  - Configuring global profiles
  - Backing up and restoring configurations in multi-VDOM mode
  - Inter-VDOM routing configuration example: Internet access
  - Inter-VDOM routing configuration example: Partial-mesh VDOMs
- High Availability
  - FGCP
  - FGSP
  - Standalone configuration synchronization
    - Layer 3 unicast standalone configuration synchronization
  - VRRP
  - Session failover
- SNMP
  - Basic configuration
  - MIB files
  - Access control for SNMP
  - Important SNMP traps
  - SNMP examples
- Replacement messages
- Replacement message groups
- FortiGuard
  - Anycast
  - Configuring FortiGuard updates
  - Using a proxy server to connect to the FortiGuard Distribution Network
  - Manual updates
  - Automatic updates
  - Scheduled updates
  - Sending malware statistics to FortiGuard
  - Update server location
  - Filtering
  - Online security tools
  - Anycast and unicast services
  - Using FortiManager as a local FortiGuard server
  - Cloud service communication statistics
  - IoT detection service
  - FortiAP query to FortiGuard IoT service to determine device details
  - FortiGate Cloud / FDN communication through an explicit proxy
  - FDS-only ISDB package in firmware images
  - Licensing in air-gap environments
  - License expiration
- Feature visibility
- Certificates
  - Automatically provision a certificate
  - Generate a new certificate
  - Regenerate default certificates
  - Import a certificate
  - Generate a CSR
  - CA certificate
  - Remote certificate
  - Certificate revocation list
  - Export a certificate
  - Uploading certificates using an API
  - Procuring and importing a signed SSL certificate
  - Microsoft CA deep packet inspection
  - Administrative access using certificates
  - Creating certificates with XCA
  - Enrollment over Secure Transport for automatic certificate management
- Security
  - BIOS-level signature and file integrity checking
  - Real-time file system integrity checking
  - Running a file system check automatically
  - Built-in entropy source
  - FortiGate VM unique certificate
- Configuration scripts
- Workspace mode
- Custom languages
- RAID
- FortiGate encryption algorithm cipher suites
- Conserve mode
- Using APIs
- Configuration backups and reset
Fortinet Security Fabric
- Components
- Security Fabric connectors
- Using the Security Fabric
- Configuring the Security Fabric with SAML
- Security rating
  - Security Fabric score
- Automation stitches
- Public and private SDN connectors
- Endpoint/Identity connectors
- Threat feeds
- Monitoring the Security Fabric using FortiExplorer for Apple TV
  - NOC and SOC example
- Troubleshooting
  - Viewing a summary of all connected FortiGates in a Security Fabric
  - Diagnosing automation stitches
Log and Report
- Viewing event logs
- System Events log page
- Security Events log page
- Reports page
- Log settings and targets
- Logging to FortiAnalyzer
- Advanced and specialized logging
- Sample logs by log type
- Troubleshooting
WAN optimization
- Overview
- Example topologies
- Configuration examples
VM
- Amazon Web Services
- Microsoft Azure
- Google Cloud Platform
- OCI
- AliCloud
- Private cloud
- VM license
- Permanent trial mode for FortiGate-VM
- Adding VDOMs with FortiGate v-series
- PF and VF SR-IOV driver and virtual SPU support
- Using OCI IMDSv2
- FIPS cipher mode for AWS, Azure, OCI, and GCP FortiGate-VMs
- Cloud-init
- TPM support for FortiGate-VM
Hyperscale firewall
Troubleshooting
- Troubleshooting methodologies
- Connectivity Fault Management
- Troubleshooting scenarios
- CLI troubleshooting cheat sheet
- CLI error codes
- Additional resources
Change Log

Home FortiGate / FortiOS 7.4.5 Administration Guide

7.4.5

General IPsec VPN configuration

The following sections provide instructions on general IPsec VPN configurations:

General IPsec VPN configuration

The following sections provide instructions on general IPsec VPN configurations:

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

Administration Guide

General IPsec VPN configuration

General IPsec VPN configuration

General IPsec VPN configuration

General IPsec VPN configuration