Establish IPSec VPN with FortiGate

Establish IPSec VPN with FortiGate

FortiWAN supports the IPSec VPN established with a FortiGate unit. However, the deployment of IPSec VPN established between FortiWAN and FortiGate is limited by the Spec. of FortiWAN’s IPSec (See “About FortiWAN IPSec VPN”). For example, IPSec Transport mode, IKE v2, authentication with certificates, IKE phase 1 aggressive mode, NAT traversal, dynamic IP address, and some algorithms are not supported for this deployment. An example for explaining how to set up a simple IPSec VPN (Tunnel mode) between a FortiWAN and a FortiGate is introduced below:

In this example, the common parameters for establishing IPSec SAs between the two units are as follows:

l Authentication Method: Pre-shared Key l Phase 1 Mode: Main (ID protection) l Dead Peer Detection: disable l Phase 1 Encryption: DES l Phase 1 Authentication: MD5 l Phase 1 DH Group: 5 l Phase 1 Keylife: 1200 Secs l Phase 2 Encryption: DES l Phase 2 Authentication: MD5 l Perfect Forward Secrecy (PFS): enable l Phase 2 DH Group: 5 l Phase 2 Keylife: 120 Secs

Configurations on FortiWAN

To set up the IPSec VPN, configurations of Network Setting, Auto Routing, NAT and IPSec are required on FortiWAN (See “Define routing policies for an IPSec VPN”).

Network Setting

WAN settings

Go to System > Network Setting > WAN Setting, and create a WAN link configuration:

For the details of WAN link setting, see “Configurations for a WAN link in Routing Mode”, “Configurations for a WAN link in Bridge Mode: One Static IP” and “Configurations for a WAN link in Bridge Mode: Multiple Static IP”.

LAN private subnets

Go to System > Network Setting > LAN Private Subnet, and create a LAN subnet configuration:

For the details of LAN private subnet setting, see “LAN Private Subnet”.

Auto Routing

Go to Service > Auto Routing, and create a policy and two IPv4 filters for IKE negotiations and IPSec communication.

Policy

IPv4 Filter

Two IPv4 filters: one for IKE negotiations, and another for general IPSec communication.

For the details of Auto Routing, see “Auto Routing”.

NAT

Go to Service > NAT, and create a NAT rule:

For the details of NAT, see “NAT”.

IPSec

Go to Service > IPSec, and create a Tunnel Mode:

Phase 1

Phase 2

So far, it is complete to set up the IPSec VPN on the FortiWAN side, configurations on the FortiGate side are introduced next. For the details of IPSec parameters, see “IPSec VPN in the Web UI”.

Configurations on FortiGate

To set up the IPSec VPN, configurations of Network, Router and VPN are required on FortiGate. For further information of FortiGate configurations, see FortiOS Handbook on Fortinet document site.

Network

Go to System > Network > Interface. Configure the setting for WAN 1 with IP address 10.12.136.180 on a physical interface.

VPN

Go to VPN > IPsec > Tunnels and click Create New.

Select “Custom VPN Tunnel (No Template)” and click Next to configure the settings as follows: Network

Authentication

Phase 1 Proposal

XAUTH

Phase 2 Selectors

Phase 2 Proposal

Router

Go to Router > Static > Static Routes, and click Create New to create two rules for WAN1 and the IPSec tunnel – IPSec_to_FWN_P1:

Firewall