The name of the IPsec tunnel cannot be changed.

An optional description of the IPsec tunnel.

Select Edit to make changes.

This option is set to IPv4.

This option is set to Static IP Address for a remote peer that has a static IP address.

Enter the IP address of the remote peer.

Select the name of the interface through which remote peers connect to the FortiProxy unit.

Enable this option to configure a local gateway and then select Primary IP, Secondary IP, or Specify. Enter or select the IP address.

Select Enable if a NAT device exists between the local FortiProxy unit. and the VPN peer or client. The local FortiProxy unit and the VPN peer or client must have the same NAT traversal setting (both selected or both cleared) to connect reliably. Additionally, you can force IPsec to use NAT traversal.

If this option is set to Forced, the FortiProxy unit uses a port value of zero when constructing the NAT discovery hash for the peer. This causes the peer to think it is behind a NAT device, and it will use UDP encapsulation for IPsec, even if no NAT is present. This approach maintains interoperability with any IPsec implementation that supports the NAT-T RFC.

If you selected Enable or Forced for the NAT traversal, enter a keep-alive frequency.

Select Egress or Ingress.

Select Enabled if you want to add a route.

Select Enabled to automatically discover the sender.

Select Enabled to automatically discover the receiver.

Select Edit to make changes.

Select Pre-shared Key or Signature:

• Pre-shared Key—A preshared key contains at least six random alphanumeric characters. Users of the VPN must obtain the preshared key from the person who manages the VPN server and add the preshared key to their VPN client configuration.

• Signature—Use one or more certificates for authentication.

If you selected Pre-shared Key for the authentication method, enter the pre-shared key that the FortiProxy unit will use to authenticate itself to the remote peer or dial-up client during Phase 1 negotiations. You must define the same key at the remote peer or client.

The key must contain at least 6 printable characters. For optimum protection against currently known attacks, the key must consist of a minimum of 16 randomly chosen alphanumeric characters. The limit is 128 characters.

If you selected Signature for the authentication method, select + and then select one or more certificates that the FortiProxy unit will use to authenticate itself.

IKE version 1 is selected by default.

Select Aggressive or Main (ID protection):

• Main (ID protection)—The Phase 1 parameters are exchanged in multiple rounds with encrypted authentication information.

• Aggressive—The Phase 1 parameters are exchanged in single message with authentication information that is not encrypted.

Select Edit to make changes.

Select Add to get another row of Encryption and Authentication options.

Select DES, 3DES, AES128, AES192, AES256 to use as the encryption algorithm.

Select MD5, SHA1, SHA256, SHA384, or SHA512 to use for authentication.

Select one or more Diffie-Hellman (DH) asymmetric key algorithms for public key cryptography.

Enter the time (in seconds) that must pass before the IKE encryption key expires. When the key expires, a new key is generated without interrupting service. The key lifetime can be from 120 to 172,800 seconds.

A Local ID is an alphanumeric value.

Select Edit to make changes.

Select Client to require an additional user name and password for authentication.

If you selected Client, enter a user name for authentication.

If you selected Client, enter a password for authentication.

Select Add to enter new phase-2 information.

Enter the Phase-2 name.

An optional description of the VPN tunnel.

Select Subnet, IP Range, IP Address, Named Address,IPv6 Subnet, IPv6 Range, IPv6 Address, or Named IPv6 Address and then enter the specified information.

Select Subnet, IP Range, IP Address, Named Address,IPv6 Subnet, IPv6 Range, IPv6 Address, or Named IPv6 Address and then enter the specified information.

Select Add to get another row of Encryption and Authentication options.

Select DES, 3DES, AES128, AES128GCM, AES192, AES256 or CHACHA20POLY1305 to use as the encryption algorithm.

Select MD5, SHA1, SHA256, SHA384, or SHA512 to use for authentication.

Replay attacks occur when an unauthorized party intercepts a series of IPsec packets and replays them back into the tunnel.

Enable for PFS.

Select All or enter the local port number.

Select All or enter the remote port number.

Select All or enter the protocol number.

Enable the option if you want the tunnel to be automatically renegotiated when the tunnel expires.

Select the check box if you want the tunnel to remain active when no data is being processed.

Select the method for determining when the Phase 2 key expires: Seconds, Kilobytes, or Both. If you select Both, the key expires when either the time has passed or the number of kilobytes have been processed.

If you selected Seconds or Both for the key lifetime, enter the number of seconds.