Fortinet Document Library

Version:

Version:


Table of Contents

Admin Guide (Standalone)

Download PDF
Copy Link

Configure VPN

VPN configurations include the following operations:

  • Configure phase-1 parameters
  • Configure phase-2 parameters
  • Configure firewall policies
  • Configure route

Configure phase-1 parameters

Use the following commands to configure a VPN tunnel.

CLI command

Description

ike-version

Specify the IKE protocol version, 1 or 2.

keylife

Specify the time (in seconds) to wait before the Phase-1 encryption key expires. The valid range is 20 –172800.

proposal

Specify Phase-1 proposal.

Dhgrp

Select one of the following DH groups:

  • 1
  • 2
  • 5
  • 14

*interface

Use either of the following:

  • wan
  • eth1/lte1/lte2

type

Select a remote gateway type:

  • static
  • ddns

*remote-gw

Specify the IPv4 address of the remote gateway’s external interface.

*remotegw-ddns

Specify the domain name of the remote gateway, e.g., xyz.DDNS.com.

authmethod

Select an authentication method:

  • psk(pre-shared key)
  • signature

*psksecret

Specify the pre-shared secret created when configuring the VPN client.

*certificate

set certificate <local-cert-name> Specify the name of local signed personal certificates. This entry is only available when authmethod is set to signature. You can enter the names of up to four signed personal certificates for the FortiExtender unit. The certificates must have already been installed on the FortiExtender before you are trying to enter them here.

*peer

set peer <ca-cert-name> This is the name of the CA certificate used to constrain that the peer certificate is issued by it or its sub-CA. This entry is available only when authmethod is set to signature. The certificates must have already been installed on the FortiExtender before you are trying to enter them here.

Note: If no peer is set, the peer certificate can still be accepted as long as a CA certificate that can verify the peer certificate exists.

Localid

Specify the local ID.

peerid

Accept the peer ID.

A Phase-1 interface can be of two categories:

  • A static remote VPN gateway with a fixed IP address.
  • A DDNS with a dynamic IP address functioning as a dynamic DNS client.

A Phase-1 interface can support the following two authentication methods:

  • psk (pre-shared key)
  • signature

When a psk is configured, the psksecret must be configured as well. When signature is chosen, it uses the default Fortinet certs for authentication. Signature mode only supports FortiGate or FortiExtender (Standalone) as a remote gateway.

A tunnel interface is created in the system interface list when an IPSec Phase-1 is successfully created.

Configure phase-2 parameters

Parameter

Description

phase1name

The name of Phase-1 which determines the options required for Phase- 2.

proposal

Phase-2 proposal.

pfs

Select either of the following:

  • enable
  • disable

Dhgrp

Phase-2 DH group.

keylife-type

Key life type.

keylifeseconds

Phase-2 key life time in seconds.

Note: The valid range is 120—172800.

encapsulation

ESP encapsulation mode

protocol

Quick mode protocol selector.

Note: The valid range is 1—255. 0 means for all.

src-addr-type

Local proxy ID type. Select one of the following:

  • subnet— IPv4 subnet
  • range —IPv4 range
  • ip —IPv4 IP
  • name — IPv4 network address name

src-subnet

Local proxy ID subnet.

Note: This field is only available when src-addr-type is set to subnet.

src-start-ip

Local proxy ID start.

Note: This field is only available when src-addr-type is set to either range or ip.

src-end-ip

Local proxy ID end.

Note: This field is only available when src-addr-type is set to range.

src-name

Local proxy ID name.

Note: This field is only available when src-addr-type is set to name.

src-port

Quick mode source port.

Note: The valid range is 1—65535. 0 means for all.

dst-addr-type

Remote proxy ID type. Select one of the following:

subnet— IPv4 subnet

range —IPv4 range

ip —IPv4 IP

name— IPv4 network address name

dst-subnet

Remote proxy ID subnet.

Note: The field is only available when dst-addr-type is set to subnet.

dst-start-ip

Remote proxy ID start.

Note: This field is only available when dst-addr-type is set to either range or ip.

dst-end-ip

Remote proxy ID end.

Note: This field is only available when dst-addr-type is set to range.

dst-name

Remote proxy ID name.

Note: This field is only available when dst-addr-type is set to name.

dst-port

Quick mode destination port.

Note: The valid range is 1—65535. 0 means for all.

Example VPN configuration:
FX201E5919002631 # config vpn ipsec phase1-interface
FX201E5919002631 (phase1-interface) #
config phase1-interface
    edit fcs-0-phase-1
        set ike-version 2
        set keylife 8000
        set proposal aes128-sha256 aes256-sha256 3des-sha256
        aes128-sha1 aes256-sha1 3des-sha1
        set dhgrp 14 5
        set interface eth1
        set type static
        set remote-gw 34.207.95.79
        set authmethod psk
        set psksecret HG709!ppA#d
        set localid FX04DA5918004527
        set peerid
    next
end
FX201E5919002631 # config network address
FX201E5919002631 (address) # show
    config network address
        edit local_subnet
        set type ipmask
        set subnet 192.168.2.0/24
    next
    edit remote_subnet
        set type ipmask
        set subnet 192.168.10.0/24
    next
end
FX201E5919002631 # config vpn ipsec phase2-interface
FX201E5919002631 (phase2-interface) #
    edit fcs-0-phase-2
        set phase1name fcs-0-phase-1
        set proposal aes128-sha1 aes256-sha1 3des-sha1
        aes128-sha256 aes256-sha256 3des-sha256
        set pfs enable
        set dhgrp 14 5
        set keylife-type seconds
        set keylifeseconds 86400
        set encapsulation tunnel-mode
        set protocol 0
        set src-type name
        set src-name local_subnet
        set src-port 0
        set dst-type name
        set dst-name remote_subnet
        set dst-port 0
    next
end
FX201E5919002631 # config firewall policy
FX201E5919002631 (policy) # show
config firewall policy
    edit to_remote
        set srcintf lan
        set dstintf fcs-0-phase-1
        set srcaddr local_subnet
        set dstaddr remote_subnet
        set action accept
        set status enable
        set service ALL
        set nat disable
    next
    edit from_remote
        set srcintf fcs-0-phase-1
        set dstintf lan
        set srcaddr remote_subnet
        set dstaddr local_subnet
        set action accept
        set status enable
        set service ALL
        set nat disable
next
end
FX201E5919002631 # config router static
FX201E5919002631 (static) # show
config router static
    edit to_remote
        set status enable
        set dst 192.168.10.0/24
        set gateway
        set distance 1
        set device fcs-0-phase-1
        set comment
    next
end

Configure firewall policies

You must define two ACCEPT firewall polices to permit communications between the source and destination addresses.

config firewall policy
     edit to_remote
         set srcaddr <The address name for the private network behind this FortiExtender unit>
         set dstaddr <The address name that you defined for the private network behind the remote peer>
         set service ALL
         set nat disable
         set srcintf <The interface that connects to the private network behind this FortiExtender unit>
         set dstintf <The VPN Tunnel (IPsec Interface)>
         set status enable
     next
     edit from_remote
         set srcaddr <The address name that you defined for the private network behind the remote peer>
         set dstaddr <The address name for the private network behind this FortiExtender unit>
         set service ALL
         set nat disable
         set srcintf <The VPN Tunnel (IPsec Interface)>
         set dstintf <The interface that connects to the private network behind this FortiExtender unit>
         set status enable
     next
end

Configure static routes

All network traffic must have a static route to direct its traffic to the proper destination. Without a route, traffic will not flow even if the firewall policies are configured properly. You may need to create a static route entry for both directions of VPN traffic if your firewall policies allow bi-directional tunnel initiation.

config router static
    edit to_remote
        set status enable
        set dst <The address name that you defined for the private network behind the remote peer>
        set gateway <Leave as default: 0.0.0.0>
        set distance <Leave this at its default>
        set device <The VPN Tunnel (IPsec Interface)>
        set comment
    next
end
Tooltip

If there are other routes on the FortiExtender unit, you may need to set the distance on this route so the VPN traffic will use it as the default route. However, this normally happens by default because this route is typically a better match than the generic default route.

Configure VPN

VPN configurations include the following operations:

  • Configure phase-1 parameters
  • Configure phase-2 parameters
  • Configure firewall policies
  • Configure route

Configure phase-1 parameters

Use the following commands to configure a VPN tunnel.

CLI command

Description

ike-version

Specify the IKE protocol version, 1 or 2.

keylife

Specify the time (in seconds) to wait before the Phase-1 encryption key expires. The valid range is 20 –172800.

proposal

Specify Phase-1 proposal.

Dhgrp

Select one of the following DH groups:

  • 1
  • 2
  • 5
  • 14

*interface

Use either of the following:

  • wan
  • eth1/lte1/lte2

type

Select a remote gateway type:

  • static
  • ddns

*remote-gw

Specify the IPv4 address of the remote gateway’s external interface.

*remotegw-ddns

Specify the domain name of the remote gateway, e.g., xyz.DDNS.com.

authmethod

Select an authentication method:

  • psk(pre-shared key)
  • signature

*psksecret

Specify the pre-shared secret created when configuring the VPN client.

*certificate

set certificate <local-cert-name> Specify the name of local signed personal certificates. This entry is only available when authmethod is set to signature. You can enter the names of up to four signed personal certificates for the FortiExtender unit. The certificates must have already been installed on the FortiExtender before you are trying to enter them here.

*peer

set peer <ca-cert-name> This is the name of the CA certificate used to constrain that the peer certificate is issued by it or its sub-CA. This entry is available only when authmethod is set to signature. The certificates must have already been installed on the FortiExtender before you are trying to enter them here.

Note: If no peer is set, the peer certificate can still be accepted as long as a CA certificate that can verify the peer certificate exists.

Localid

Specify the local ID.

peerid

Accept the peer ID.

A Phase-1 interface can be of two categories:

  • A static remote VPN gateway with a fixed IP address.
  • A DDNS with a dynamic IP address functioning as a dynamic DNS client.

A Phase-1 interface can support the following two authentication methods:

  • psk (pre-shared key)
  • signature

When a psk is configured, the psksecret must be configured as well. When signature is chosen, it uses the default Fortinet certs for authentication. Signature mode only supports FortiGate or FortiExtender (Standalone) as a remote gateway.

A tunnel interface is created in the system interface list when an IPSec Phase-1 is successfully created.

Configure phase-2 parameters

Parameter

Description

phase1name

The name of Phase-1 which determines the options required for Phase- 2.

proposal

Phase-2 proposal.

pfs

Select either of the following:

  • enable
  • disable

Dhgrp

Phase-2 DH group.

keylife-type

Key life type.

keylifeseconds

Phase-2 key life time in seconds.

Note: The valid range is 120—172800.

encapsulation

ESP encapsulation mode

protocol

Quick mode protocol selector.

Note: The valid range is 1—255. 0 means for all.

src-addr-type

Local proxy ID type. Select one of the following:

  • subnet— IPv4 subnet
  • range —IPv4 range
  • ip —IPv4 IP
  • name — IPv4 network address name

src-subnet

Local proxy ID subnet.

Note: This field is only available when src-addr-type is set to subnet.

src-start-ip

Local proxy ID start.

Note: This field is only available when src-addr-type is set to either range or ip.

src-end-ip

Local proxy ID end.

Note: This field is only available when src-addr-type is set to range.

src-name

Local proxy ID name.

Note: This field is only available when src-addr-type is set to name.

src-port

Quick mode source port.

Note: The valid range is 1—65535. 0 means for all.

dst-addr-type

Remote proxy ID type. Select one of the following:

subnet— IPv4 subnet

range —IPv4 range

ip —IPv4 IP

name— IPv4 network address name

dst-subnet

Remote proxy ID subnet.

Note: The field is only available when dst-addr-type is set to subnet.

dst-start-ip

Remote proxy ID start.

Note: This field is only available when dst-addr-type is set to either range or ip.

dst-end-ip

Remote proxy ID end.

Note: This field is only available when dst-addr-type is set to range.

dst-name

Remote proxy ID name.

Note: This field is only available when dst-addr-type is set to name.

dst-port

Quick mode destination port.

Note: The valid range is 1—65535. 0 means for all.

Example VPN configuration:
FX201E5919002631 # config vpn ipsec phase1-interface
FX201E5919002631 (phase1-interface) #
config phase1-interface
    edit fcs-0-phase-1
        set ike-version 2
        set keylife 8000
        set proposal aes128-sha256 aes256-sha256 3des-sha256
        aes128-sha1 aes256-sha1 3des-sha1
        set dhgrp 14 5
        set interface eth1
        set type static
        set remote-gw 34.207.95.79
        set authmethod psk
        set psksecret HG709!ppA#d
        set localid FX04DA5918004527
        set peerid
    next
end
FX201E5919002631 # config network address
FX201E5919002631 (address) # show
    config network address
        edit local_subnet
        set type ipmask
        set subnet 192.168.2.0/24
    next
    edit remote_subnet
        set type ipmask
        set subnet 192.168.10.0/24
    next
end
FX201E5919002631 # config vpn ipsec phase2-interface
FX201E5919002631 (phase2-interface) #
    edit fcs-0-phase-2
        set phase1name fcs-0-phase-1
        set proposal aes128-sha1 aes256-sha1 3des-sha1
        aes128-sha256 aes256-sha256 3des-sha256
        set pfs enable
        set dhgrp 14 5
        set keylife-type seconds
        set keylifeseconds 86400
        set encapsulation tunnel-mode
        set protocol 0
        set src-type name
        set src-name local_subnet
        set src-port 0
        set dst-type name
        set dst-name remote_subnet
        set dst-port 0
    next
end
FX201E5919002631 # config firewall policy
FX201E5919002631 (policy) # show
config firewall policy
    edit to_remote
        set srcintf lan
        set dstintf fcs-0-phase-1
        set srcaddr local_subnet
        set dstaddr remote_subnet
        set action accept
        set status enable
        set service ALL
        set nat disable
    next
    edit from_remote
        set srcintf fcs-0-phase-1
        set dstintf lan
        set srcaddr remote_subnet
        set dstaddr local_subnet
        set action accept
        set status enable
        set service ALL
        set nat disable
next
end
FX201E5919002631 # config router static
FX201E5919002631 (static) # show
config router static
    edit to_remote
        set status enable
        set dst 192.168.10.0/24
        set gateway
        set distance 1
        set device fcs-0-phase-1
        set comment
    next
end

Configure firewall policies

You must define two ACCEPT firewall polices to permit communications between the source and destination addresses.

config firewall policy
     edit to_remote
         set srcaddr <The address name for the private network behind this FortiExtender unit>
         set dstaddr <The address name that you defined for the private network behind the remote peer>
         set service ALL
         set nat disable
         set srcintf <The interface that connects to the private network behind this FortiExtender unit>
         set dstintf <The VPN Tunnel (IPsec Interface)>
         set status enable
     next
     edit from_remote
         set srcaddr <The address name that you defined for the private network behind the remote peer>
         set dstaddr <The address name for the private network behind this FortiExtender unit>
         set service ALL
         set nat disable
         set srcintf <The VPN Tunnel (IPsec Interface)>
         set dstintf <The interface that connects to the private network behind this FortiExtender unit>
         set status enable
     next
end

Configure static routes

All network traffic must have a static route to direct its traffic to the proper destination. Without a route, traffic will not flow even if the firewall policies are configured properly. You may need to create a static route entry for both directions of VPN traffic if your firewall policies allow bi-directional tunnel initiation.

config router static
    edit to_remote
        set status enable
        set dst <The address name that you defined for the private network behind the remote peer>
        set gateway <Leave as default: 0.0.0.0>
        set distance <Leave this at its default>
        set device <The VPN Tunnel (IPsec Interface)>
        set comment
    next
end
Tooltip

If there are other routes on the FortiExtender unit, you may need to set the distance on this route so the VPN traffic will use it as the default route. However, this normally happens by default because this route is typically a better match than the generic default route.