Basic site-to-site VPN

Leave a reply

Basic site-to-site VPN

IPsec VPN in an HA environment

This recipe provides sample configuration of site-to-site IPsec VPN in an HA environment. You must enable two options to ensure IPsec VPN traffic does not interrupt during an HA failover:

  • session-pickup under HA settings
  • ha-sync-esp-seqno under IPsec phase1-interface settings The following shows the sample network topology for this recipe:

You can configure IPsec VPN in an HA environment using the FortiOS GUI or CLI.

In this examples below, the VPN name for HQ1 is “to_HQ2”, and the VPN name for HQ2 is “to_HQ1”.

To configure IPsec VPN in an HA environment on the GUI:

  1. Set up HA as described in the HA topics.
  2. Set up IPsec VPN on HQ1 (the HA cluster):
    1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
      1. Enter a proper VPN name.
      2. For Template Type, choose Site to Site. For Remote Device Type, select FortiGate. iv. For NAT Configuration, set No NAT Between Sites.
      3. Click Next.
    2. Configure the following settings for Authentication:
      1. For Remote Device, select IP Address. In the IP address field, enter 172.16.202.1. iii. In the Outgoing Interface field, enter port1.
      2. For Authentication Method, select Pre-shared Key.
      3. In the Pre-shared Key field, enter an example key.
      4. Click Next.
      5. Configure the following settings for Policy & Routing:
    3. From the Local Interface dropdown menu, select the desired local interface.
    4. Configure the Local Subnets as 10.1.100.0/24.
  • Configure the Remote Subnets as 172.16.101.0/24.
  1. Click Create.
  2. Set up IPsec VPN on HQ2:
  1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
    1. Enter a proper VPN name.
    2. For Template Type, choose Site to Site. For Remote Device Type, select FortiGate. iv. For NAT Configuration, set No NAT Between Sites.
    3. Click Next.
  2. Configure the following settings for Authentication:
    1. For Remote Device, select IP Address. In the IP address field, enter 172.16.200.1. iii. In the Outgoing Interface field, enter port13.
    2. For Authentication Method, select Pre-shared Key.
    3. In the Pre-shared Key field, enter an example key.
    4. Click Next.
  3. Configure the following settings for Policy & Routing:
    1. From the Local Interface dropdown menu, select the desired local interface. In this example, it is port9.
    2. Configure the Local Subnets as 172.16.101.0. Configure the Remote Subnets as 10.1.100.0 iv. Click Create.

To configure IPsec VPN in an HA environment using the CLI:

  1. Configure HA. In this example, two FortiGates work in active-passive mode. The HA heartbeat interfaces are WAN1 and WAN2:

config system ha set group-name “FGT-HA” set mode a-p set password sample set hbdev “wan1” 50 “wan2” 50 set session-pickup enable set priority 200 set override-wait-time 10

end

  1. Configure the WAN interface and default route. The WAN interface is the interface connected to the ISP. It can work in static mode (as shown in the example), DHCP, or PPPoE mode. The IPsec tunnel is established over the WAN interface.
  2. Configure HQ1:

config system interface edit “port1” set vdom “root”

set ip 172.16.200.1 255.255.255.0

next end config router static edit 1 set gateway 172.16.200.3 set device “port1”

next

end

  1. Configure HQ2:

config system interface edit “port25” set vdom “root”

set ip 172.16.202.1 255.255.255.0

next

end

config router static edit 1 set gateway 172.16.202.2 set device “port25”

next

end

  1. Configure the internal (protected subnet) interface. The internal interface connects to corporate internal network.

Traffic from this interface routes out the IPsec VPN tunnel. a. Configure HQ1:

config system interface edit “dmz” set vdom “root”

set ip 10.1.100.1 255.255.255.0

next

end

  1. Configure HQ2:

config system interface edit “port9” set vdom “root”

set ip 172.16.101.1 255.255.255.0

next

end

  1. Configure the IPsec phase1-interface. In this example, PSK is used as the authentication method. Signature authentication is also an option. Configure HQ1:

config vpn ipsec phase1-interface edit “to_HQ2” set interface “port1” set peertype any set net-device enable set ha-sync-esp-seqno enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set remote-gw 172.16.202.1 set psksecret sample

next

end

  1. Configure HQ2:

config vpn ipsec phase1-interface edit “to_HQ1” set interface “port25” set peertype any set net-device enable

set ha-sync-esp-seqno enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set remote-gw 172.16.200.1 set psksecret sample

next

  1. Configure the IPsec phase2-interface:
    1. Configure HQ1:

config vpn ipsec phase2-interface edit “to_HQ2” set phase1name “to_HQ2”

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

end

  1. Configure HQ2:

config vpn ipsec phase2-interface edit “to_HQ1” set phase1name “to_HQ1”

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

end

  1. Configure static routes. Two static routes are added to reach the remote protected subnet. The blackhole route is important to ensure that IPsec traffic does not match the default route when the IPsec tunnel is down. Configure HQ1:

config router static edit 2 set dst 172.16.101.0 255.255.255.0 set device “to_HQ2”

next edit 3 set dst 172.16.101.0 255.255.255.0 set blackhole enable set distance 254

next

end

  1. Configure HQ2:

config router static edit 2 set dst 10.1.100.0 255.255.255.0 set device “to_HQ1”

next edit 3 set dst 10.1.100.0 255.255.255.0 set blackhole enable set distance 254

next

end

  1. Configure two firewall policies to allow bi-directional IPsec traffic flow over the IPsec tunnel: a. Configure HQ1:

config firewall policy edit 1 set name “inbound”

set srcintf “to_HQ2” set dstintf “dmz” set srcaddr “172.16.101.0” set dstaddr “10.1.100.0” set action accept set schedule “always” set service “ALL”

next edit 2 set name “outbound” set srcintf “dmz” set dstintf “to_HQ2” set srcaddr “10.1.100.0” set dstaddr “172.16.101.0” set action accept set schedule “always” set service “ALL”

next

end

  1. Configure HQ2:

config firewall policy edit 1 set name “inbound” set srcintf “to_HQ1” set dstintf “port9” set srcaddr “10.1.1.00.0” set dstaddr “172.16.101.0” set action accept set schedule “always” set service “ALL”

next edit 2 set name “outbound” set srcintf “port9” set dstintf “to_HQ1” set srcaddr “172.16.101.0” set dstaddr “10.1.100.0” set action accept set schedule “always” set service “ALL”

next

end

  1. Run diagnose commands. These diagnose commands are useful to check IPsec phase1/phase2 interface statuses, including the sequence number on the secondary FortiGate. The diagnose debug application ike -1 command is the key to figure out why the IPsec tunnel failed to establish.
  2. Run the HQ1 # diagnose vpn ike gateway list command. The system should return the following:

vd: root/0 name: to_HQ2 version: 1 interface: port1 11 addr: 172.16.200.1:500 -> 172.16.202.1:500

created: 5s ago

IKE SA: created 1/1 established 1/1 time 0/0/0 ms

IPsec SA: created 2/2 established 2/2 time 0/0/0 ms

id/spi: 12 6e8d0532e7fe8d84/3694ac323138a024 direction: responder status:

established 5-5s ago = 0ms proposal: aes128-sha256 key: b3efb46d0d385aff-

7bb9ee241362ee8d lifetime/rekey: 86400/86124 DPD sent/recv: 00000000/00000000

  1. Run the HQ1 # diagnose vpn tunnel list command. The system should return the following: list all ipsec tunnel in vd 0

name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0

bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_ dev frag-rfc accept_traffic=1

proxyid_num=1 child_num=0 refcnt=11 ilast=7 olast=87 ad=/0 stat: rxp=0 txp=0 rxb=0 txb=0

dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=42927/0B replaywin=2048

seqno=1 esn=0 replaywin_lastseq=00000000 itn=0

life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7

ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b

enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3

dec:pkts/bytes=0/0, enc:pkts/bytes=0/0

ESP seqno synced to primary FortiGate every five minutes, and big gap between primary and secondary to ensure that no packet is dropped after HA failover caused by tcp-replay. Check ESP sequence number synced on secondary FortiGate.

  1. Run the HQ1 # execute ha manage 0 admin command:
  2. Run the HQ1-Slave # diagnose vpn tunnel list The system should return the following:

list all ipsec tunnel in vd 0

name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0

bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_ dev frag-rfc accept_traffic=1

proxyid_num=1 child_num=0 refcnt=11 ilast=13 olast=274 ad=/0 stat: rxp=0 txp=0 rxb=0 txb=0

dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=27 type=00 soft=0 mtu=1280 expire=42740/0B replaywin=2048

seqno=47868c01 esn=0 replaywin_lastseq=00000000 itn=0

life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7

ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b

enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3

dec:pkts/bytes=0/0, enc:pkts/bytes=0/0

This entry was posted in Administration Guides, FortiGate, FortiOS 6.2 on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.