IPsec VPN Datasheet
IPsec VPN Datasheet
The VPN Datasheet below can be exchange with your VPN partner in order to work on the same information basis.
VPN Site 1 | VPN Site 2 |
Company A | Company B |
Requested by: | Requested by: |
Planning contact: | Planning contact: |
Responsible for installation: | Responsible for installation: |
VPN Gateway
Hardware Vendor & Version: FortiGate V _._._ | Hardware Vendor & Version: |
External IP address: | External IP address: |
Encryption Domain / Crypto Map: | Encryption Domain / Crypto Map: |
VPN Phase 1 (IKE)
• IKEv1 (Aggressive) • IKEv1 (Main ID protection) • IKEv2
| Key Management: |
DH-Group (Diffie-Hellman): • Group 1 (768 bit MODP) • Group 2 (1024 bit MODP) • Group 5 (1536 bit MODP) • Group 14 (2048 bit MODP) • Group 15 (3072-bit MODP) • Group 16 (4096-bit MODP) • Group 17 (6144-bit MODP) • Group 18 (8192-bit MODP) • Group 19 (256-bit ECP) • Group 20 (384-bit ECP) • Group 21(521-bit ECP) • Group 27 (6144-bit MODP) • Group 28 (BP256 ECP) • Group 29 (BP381 ECP • Group 30 (BP512 ECP) • Group 31 (Curve25519) • Group 32 (Curve448)
| DH-Group (Diffie-Hellman): |
Encryption Algorithm: • DES • 3DES • AES-128 • AES-128GCM (Only available for IKEv2) • AES-192 • AES-256 • AES-256GCM (Only available for IKEv2) • CHACHA20POLY1305: 128-bit (Only available for IKEv2) | Encryption Algorithm: |
Hash / Data Integrity: • MD5 • SHA1 • SHA-256 → highest compatibility • SHA-384 • SHA512 → highest security | Hash: |
Pseudo Random Function (PRF): • No • Yes: (PRFSHA1, PRFSHA256, PRFSHA384, PRFSHA512) | Pseudo Random Function (PRF): • No • Yes: |
Authentication Method: • Signature • Pre-Shared Secret | Authentication Method: |
SA Lifetime / Renegotiation time: 86400 sec. (Default) | SA Lifetime: |
VPN Phase 2 (IPSec)
Encapsulation: ESP | Encapsulation: ESP |
Perfect Forward Secrecy (PFS): Yes / No | Perfect Forward Secrecy (PFS): Yes / No |
DH-Group (Diffie-Hellman): • Group 1 (768 bit MODP) • Group 2 (1024 bit MODP) • Group 5 (1536 bit MODP) • Group 14 (2048 bit MODP) • Group 15 (3072-bit MODP) • Group 16 (4096-bit MODP) • Group 17 (6144-bit MODP) • Group 18 (8192-bit MODP) • Group 19 (256-bit ECP) • Group 20 (384-bit ECP) • Group 21(521-bit ECP) • Group 27 (6144-bit MODP) • Group 28 (BP256 ECP) • Group 29 (BP381 ECP • Group 30 (BP512 ECP) • Group 31 (Curve25519) • Group 32 (Curve448)
| DH-Group (Diffie-Hellman): |
Encryption Algorithm: • NULL • DES • 3DES • AES-128 • AES128GCM (Only available for IKEv2) • AES-192 • AES-256 • AES-256GCM (Only available for IKEv2) • CHACHA20POLY1305: a 128-bit (Only available for IKEv2) | Encryption Algorithm: |
Hash / Data Integrity: • NULL • MD5 • SHA1 • SHA-256 • SHA-384 • SHA-512 | Hash: |
Aggressive Mode: Yes / No | Aggressive Mode: Yes / No |
SA Lifetime: 43200 sec. (Default) | SA Lifetime: |
VPN NAT Options |
Disable NAT inside the VPN traffic: Yes / No |
VPN Interesting Traffic
Inbound from Site 2: | Inbound from Site 1: |
Outbound to Site 2: | Outbound to Site 1: |
I didn't find a lot of best practices from official Fortinet documentation, so I'm hoping to get in touch with you all to establish a set of best practices. Let's discuss!