FortiExtender now is able to use third-party CA certificates at phase 1 to verify identity of peers and to establish IPsec VPN tunnels.
- From the Console:
execute vpn certificate ca import tftp <remote_file> <local_name> <ip>
- From the GUI: Click VPN>VPN Certificate>CA Certificate>Import New Certificate.
- From the console:
execute vpn certificate local import tftp <remote_file> <local_name> <ip> <passwd>
- From the GUI: Click VPN>VPN Certificate>Entity Certificate>Import New Certificate.
In 4.2.0, two new fields "certificate" and "peer" have been added to the phase1 interface entry. You can use them to reference the imported third-party certificates. It is important to know that these fields are available only when "authmethod" is set to signature.
You can reference the datasource "vpn.certificate.local".
For the name of local signed personal certificates, you can enter the names of up to four signed personal certificates for the FortiExtender unit. You must have the certificated already installed on the FortiExtender beforehand to be able to enter them here.
You can reference the datasource "vpn.certificate.ca".
This is the name of the CA certificate used to constrain that the peer certificate is issued by it or its sub-CA. The certificates must have already been installed on the FortiExtender before you are able to enter them here.
If the peer is not set, the peer certificate can still be accepted as long as a CA certificate that can verify the peer certificate exists.
config vpn ipsec phase1-interface edit vpn1 set ike-version 2 set keylife 86400 set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1 set dhgrp 14 5 set interface nas1 set type static set remote-gw 192.168.137.106 set authmethod signature set certificate <local_cert_name> ==> new field set peer <ca_cert_name> ==> new field set localid set peerid next end