Configuring ipsec virtual ip addresses – Fortinet 100A User Manual
Page 274
274
01-28007-0068-20041203
Fortinet Inc.
ipsec vip
VPN
This example shows how to display the settings for the vpn ipsec vip command.
get vpn ipsec vip
This example shows how to display the settings for the VIP entry named 1.
get vpn ipsec vip 1
This example shows how to display the current configuration of all existing VIP
entries.
show vpn ipsec vip
Configuring IPSec virtual IP addresses
Use the FortiGate unit’s IPSec VIP feature to enable hosts on physically different
networks to communicate with each other as if they were connected to the same
private network. This feature can be configured manually through CLI commands.
When the destination IP address in a local ARP request matches an entry in the
FortiGate unit’s virtual IP (VIP) table, the FortiGate unit responds with its own MAC
address and forwards traffic to the correct destination at the other end of the VPN
tunnel afterward.
Consider the following example, which shows two physically separate networks. The
IP addresses of the computers on both networks are in the 192.168.12.0/24 range,
but no two IP addresses are the same. An IPSec VPN has been configured between
FortiGate_1 and FortiGate_2. The FortiGate configuration permits Host_1 on the
Finance network to transmit data to Host_2 on the HR network through the IPSec
VPN tunnel.
Figure 141:A typical site-to-site configuration using the IPSec VIP feature
Note: Typing next lets you define another VIP address without leaving the vip shell.
Esc
Enter
Host_2
192.168.12.2
external
Host_1
192.168.12.1
FortiGate_1
external
Esc
Enter
FortiGate_2
Finance Network
192.168.12.0/24
HR Network
192.168.12.0/24
Internet