Fortinet FortiGate FortiGate-200A

VPN Internet browsing through a VPN tunnel
FortiGate-200A Administration Guide 01-28006-0072-20041105 283
Setting the destination address for encrypted traffic
The destination address determines which remote peers and clients will be allowed to
access the specified source address. In general:
• For a gateway-to-gateway VPN, the destination address is the static private
address space assigned to the network behind the remote peer.
• For a peer-to-peer VPN, the destination address is the static public IP address of
the remote peer.
• For remote-client configurations, the destination address is the IP address of the
remote client. If the remote client acquires a virtual IP address or a dynamic IP
address, the destination address that you specify must match the virtual or
dynamic IP address that the remote client can acquire.
To add a destination address, see “To add an address” on page 202.
Adding an IPSec firewall encryption policy
Use the following procedure to add an IPSec firewall encryption policy.
To define the firewall encryption policy
1 Go to Firewall > Address > Address.
2 Set the encryption policy direction. See “Setting the encryption policy direction” on
page 282.
3 Add the source and destination addresses. See “To add an address” on page 202.
4 Set Action to ENCRYPT.
5 From the VPN tunnel list, select a phase 2 tunnel configuration.
6 Configure the following options if required:
7 Select additional options if required to apply a protection profile and/or other firewall
policy features.
8 Select OK.
Internet browsing through a VPN tunnel
Using Internet browsing through a VPN tunnel, remote VPN users can connect to a
network behind a FortiGate unit or browse the Internet using the same VPN tunnel.
Firewall policies can apply virus scanning, web filtering, and other FortiGate features
to remote VPN traffic that connects to the Internet. Applying virus scanning and other
FortiGate features to remote VPN user Internet connections enhances the security of
remote VPN user traffic and protects remote VPN users from viruses and other threats
on the Internet. Also, if all remote VPN Internet traffic is sent over the VPN, the remote
client does not send any unencrypted traffic to the Internet.
Internet browsing through a VPN tunnel is supported between VPN peers or for a
remote VPN client. Internet browsing through a VPN tunnel is available for static IP
VPNs, dynamic DNS VPNs, and dialup VPNs.