IPsec Site2Site Certificate

[kzuk]

Hello,

I need to create VPN IPsec S2S tunnel with certificate authentication.

What i need in Subject and Key Usage/Enhanced Key Usage in that certificate?

For now i use certificate with address IP in Common Name and Client/Server Authentication (Enhanced Key Usage) on each sites.

Thats is ok?

[emnoc]

That should be fine, but  a name in the subject  field would be ideal.

Ken

[kzuk]

Name of what? UTM hostname? In VPN config I can't enter domain name. I can use only IP address.

[emnoc]

If your talking about  the CN field;  it could be something as simple as a username, hostname, email, rfc822name, etc....

[oheigl]

I think he is referring to the user peer configuration:

Enter the peer certificate common name type: FQDN — Fully-qualified domain name. email — The user’s email address. ipv4 — The user’s IP address (IPv4). ipv6 — The user’s IP address (IPv6). string — Any other piece of information.

[emnoc]

follow the   ftnt example

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ipsecvpn-54/Phase_1/Authenticating_Re...