Professional Documents
Culture Documents
Products
FortiGate v6.4
Description
Scope
Solution
Go to VPN -> IPsec Wizard and configure the following settings for VPN Setup:
- From the 'Local Interface dropdown' menu, select the 'local interface'.
- Configure the 'Local Subnets' as '10.1.100.0/24'.
- Configure 'the Remote Subnets' as '172.16.101.0/24'.
- Select 'Create'.
2) Set up IPsec VPN on HQ2:
Go to VPN- > IPsec Wizard and configure the following settings for VPN Setup:
- From the 'Local Interface dropdown' menu, select the desired local interface. In this example,
it is 'port9'.
- Configure the 'Local Subnets' as '172.16.101.0'.
- Configure the 'Remote Subnets' as '10.1.100.0'.
- Select 'Create.
1) Configure HA. In this example, two FortiGates work in active-passive mode. The HA
heartbeat interfaces are WAN1 and WAN2:
# config system ha
set group-name "FGT-HA"
set mode a-p
set password sample
set hbdev "wan1" 50 "wan2" 50
set session-pickup enable
set priority 200
set override-wait-time 10
end
2) Configure the WAN interface and default route. The WAN interface is the interface connected
to the ISP. It can work in static mode (as shown in this example), DHCP, or PPPoE mode. The
IPsec tunnel is established over the WAN interface.
- Configure HQ1:
- Configure HQ2:
3) Configure the internal (protected subnet) interface. The internal interface connects to the
corporate internal network. Traffic from this interface routes out the IPsec VPN tunnel.
- Configure HQ1:
- Configure HQ2:
4) Configure the IPsec phase1-interface. This example uses PSK as the authentication method.
You can also use signature authentication.
- Configure HQ1:
- Configure HQ2:
- Configure HQ1:
# config vpn ipsec phase2-interface
edit "to_HQ2"
set phase1name "to_HQ2"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-
sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
end
- Configure HQ2:
# config vpn ipsec phase2-interface
edit "to_HQ1"
set phase1name "to_HQ1"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-
sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
end
6) Configure static routes. Two static routes are added to reach the remote protected subnet.
The blackhole route is important to ensure IPsec traffic does not match the default route when
the IPsec tunnel is down.
- Configure HQ1:
- Configure HQ2:
# config router static
edit 2
set dst 10.1.100.0 255.255.255.0
set device "to_HQ1"
next
edit 3
set dst 10.1.100.0 255.255.255.0
set blackhole enable
set distance 254
next
end
7) Configure two firewall policies to allow bi-directional IPsec traffic flow over the IPsec tunnel:
- Configure HQ1:
- Configure HQ2:
8) Use the following diagnose commands to check IPsec phase1/phase2 interface status
including the sequence number on the secondary FortiGate.
The diagnose debug application ike -1 command is the key to troubleshoot why the IPsec
tunnel failed to establish.
- Run the HQ1 # diagnose vpn ike gateway list command. The system should return the
following:
vd: root/0
name: to_HQ2
version: 1
interface: port1 11
addr: 172.16.200.1:500 -> 172.16.202.1:500
created: 5s ago
IKE SA: created 1/1 established 1/1 time 0/0/0 ms
IPsec SA: created 2/2 established 2/2 time 0/0/0 ms
id/spi: 12 6e8d0532e7fe8d84/3694ac323138a024 direction: responder
status: established 5-5s ago = 0ms proposal: aes128-sha256 key:
b3efb46d0d385aff-7bb9ee241362ee8d lifetime/rekey: 86400/86124 DPD
sent/recv: 00000000/00000000
- Run the HQ1 # diagnose vpn tunnel list command. The system should return the
following:
list all ipsec tunnel in vd 0
- Run the HQ1-second # diagnose vpn tunnel list command. The system should return the
following: