Type a name for the Phase 1 definition.

An optional description of the VPN tunnel.

Select this option if you want to create an IPsec VPN tunnel.

This option is set to IPv4.

This option is set to Static IP Address for a remote peer that has a static IP address.

Enter the IP address of the remote peer.

Select the name of the interface through which remote peers connect to the FortiProxy unit.

Enable this option to configure a local gateway and then select Primary IP, Secondary IP, or Specify. Enter or select the IP address.

Select Enable if a NAT device exists between the local FortiProxy unit. and the VPN peer or client. The local FortiProxy unit and the VPN peer or client must have the same NAT traversal setting (both selected or both cleared) to connect reliably. Additionally, you can force IPsec to use NAT traversal.

If this option is set to Forced, the FortiProxy unit uses a port value of zero when constructing the NAT discovery hash for the peer. This causes the peer to think it is behind a NAT device, and it will use UDP encapsulation for IPsec, even if no NAT is present. This approach maintains interoperability with any IPsec implementation that supports the NAT-T RFC.

If you selected Enable or Forced for the NAT traversal, enter a keep-alive frequency.

Select On Idle to reestablish VPN tunnels on idle connections and clean up dead IKE peers if required. You can use this option to receive notification whenever a tunnel goes up or down, or to keep the tunnel connection open when no traffic is being generated inside the tunnel.

With On Idle or On Demand selected, you can use the config vpn ipsec phase1 (tunnel mode) or config vpn ipsec phase1-interface (interface mode) CLI command to optionally specify a retry count and a retry interval.

Select Pre-shared Key or Signature:

• Pre-shared Key—A preshared key contains at least six random alphanumeric characters. Users of the VPN must obtain the preshared key from the person who manages the VPN server and add the preshared key to their VPN client configuration.

• Signature—Use one or more certificates for authentication.

If you selected Pre-shared Key for the authentication method, enter the pre-shared key that the FortiProxy unit will use to authenticate itself to the remote peer or dial-up client during Phase 1 negotiations. You must define the same key at the remote peer or client.

The key must contain at least 6 printable characters. For optimum protection against currently known attacks, the key must consist of a minimum of 16 randomly chosen alphanumeric characters. The limit is 128 characters.

If you selected Signature for the authentication method, select + and then select one or more certificates that the FortiProxy unit will use to authenticate itself.

IKE version 1 is selected by default.

Select Aggressive or Main (ID protection):

• Main (ID protection)—The Phase 1 parameters are exchanged in multiple rounds with encrypted authentication information.

• Aggressive—The Phase 1 parameters are exchanged in single message with authentication information that is not encrypted.

If you selected Pre-shared Key for the authentication method and selected aggressive mode, select Any peer ID or Specific peer ID. If you select Specific peer ID, enter the peer ID.

If you selected Signature for the authentication method, select Any peer ID, Specific peer ID, or Peer certificate.

If you selected Any peer ID, enter the peer ID.

If you selected Peer certificate for the authentication method, select the certificate.

Select Add to get another row of Encryption and Authentication options.

Select DES, 3DES, AES128, AES192, and AES256 to use as the encryption algorithm. AES256 is the most secure; DES is the least secure.

Select MD5, SHA1, SHA256, SHA384, SHA512, or SHA256 to use for authentication.

Select one or more Diffie-Hellman (DH) asymmetric key algorithms for public key cryptography.

Enter the time (in seconds) that must pass before the IKE encryption key expires. When the key expires, a new key is generated without interrupting service. The key lifetime can be from 120 to 172,800 seconds.

A Local ID is an alphanumeric value.

Select Client to require an additional user name and password for authentication.

If you selected Client, enter a user name for authentication.

If you selected Client, enter a password for authentication.

By default, the Phase-2 name is the same as the Phase-1 name.

An optional description of the VPN tunnel.

Select Subnet, IP Range, IP Address, Named Address,IPv6 Subnet, IPv6 Range, IPv6 Address, or Named IPv6 Address and then enter the specified information.

Select Subnet, IP Range, IP Address, Named Address,IPv6 Subnet, IPv6 Range, IPv6 Address, or Named IPv6 Address and then enter the specified information.

Select Add to get another row of Encryption and Authentication options.

Select NULL, DES, 3DES, AES128, AES128GCM, AES192, AES256, or AES256GCM to use as the encryption algorithm. NULL is the least secure; AES256GCM is the most secure.

Select NULL, MD5, SHA1, SHA256, SHA384, or SHA512 to use for authentication.

Replay attacks occur when an unauthorized party intercepts a series of IPsec packets and replays them back into the tunnel.

Perfect forward secrecy (PFS) improves security by forcing a new Diffie-Hellman exchange whenever keylife expires.

Select All or enter the local port number.

Select All or enter the remote port number.

Select All or enter the protocol number.

Enable the option if you want the tunnel to be automatically renegotiated when the tunnel expires.

Select the check box if you want the tunnel to remain active when no data is being processed.

Select the method for determining when the Phase 2 key expires: Seconds, Kilobytes, or Both. If you select Both, the key expires when either the time has passed or the number of kilobytes have been processed.

If you selected Seconds or Both for the key lifetime, enter the number of seconds.