Fortinet black logo

FortiGate-7000F Handbook

FortiGate-7000F IPsec VPN

Copy Link
Copy Doc ID fd130345-bc33-11ec-9fd1-fa163e15d75b:813847
Download PDF

FortiGate-7000F IPsec VPN

FortiGate-7000F uses SLBC load balancing to select an FPM to terminate traffic for a new IPsec VPN tunnel instance and all traffic for that tunnel instance is terminated on the same FPM.

config vpn ipsec phase1-interface

edit <name>

set ipsec-tunnel-slot {auto | FPM3 | FPM4 | FPM5 | FPM6 | FPM7 | FPM8 | FPM9 | FPM10 | FPM11 | FPM12 | master}

end

You can optionally use the IPsec tunnel phase 1 configuration to select a specific FPM to terminate all tunnel instances started by that phase 1. For example, to terminate all tunnels on FPM5:

config vpn ipsec phase1-interface

edit <name>

set ipsec-tunnel-slot FPM5

end

FortiGate-7000F IPsec VPN supports the following features:

  • Interface-based IPsec VPN (also called route-based IPsec VPN).

  • Site-to-Site IPsec VPN.

  • Dialup IPsec VPN. The FortiGate-7000F can be the dialup server or client.

  • Static and dynamic routing (BGP, OSPF, and RIP) over IPsec VPN tunnels.

  • When an IPsec VPN tunnel is initialized, the SA is synchronized to all FPMs in the FortiGate-7000F, or in both FortiGate-7000Fs in an HA configuration.

  • Traffic between IPsec VPN tunnels is supported when both tunnels terminate on the same FPM.

  • When setting up a VRF configuration to send traffic between two IPsec VPN interfaces with different VRFs, both IPsec tunnels must terminate on the same FPM. Use the ipsec-tunnel-slot option in each IPsec VPN phase 1-interface configuration to terminate both phase 1s on the same FPM.

  • The FortiGate-7000F, because it uses NP7 processors for SLBC, supports IPsec VPN to remote networks with 0- to 15-bit netmasks.

FortiGate-7000F IPsec VPN has the following limitations:

  • Policy-based IPsec VPN tunnels terminated by the FortiGate-7000F are not supported.

  • Policy routes cannot be used for communication over IPsec VPN tunnels.

  • IPv6 clear-text traffic (IPv6 over IPv4 or IPv6 over IPv6) is not supported.

  • IPsec SA synchronization between FGSP HA peers is not supported.

  • When setting up an IPsec VPN VLAN interface, do not set the VLAN ID to 1. This VLAN ID is reserved by FortiOS. Any configurations that use a VLAN with VLAN ID = 1 will not work as expected.

FortiGate-7000F IPsec VPN

FortiGate-7000F uses SLBC load balancing to select an FPM to terminate traffic for a new IPsec VPN tunnel instance and all traffic for that tunnel instance is terminated on the same FPM.

config vpn ipsec phase1-interface

edit <name>

set ipsec-tunnel-slot {auto | FPM3 | FPM4 | FPM5 | FPM6 | FPM7 | FPM8 | FPM9 | FPM10 | FPM11 | FPM12 | master}

end

You can optionally use the IPsec tunnel phase 1 configuration to select a specific FPM to terminate all tunnel instances started by that phase 1. For example, to terminate all tunnels on FPM5:

config vpn ipsec phase1-interface

edit <name>

set ipsec-tunnel-slot FPM5

end

FortiGate-7000F IPsec VPN supports the following features:

  • Interface-based IPsec VPN (also called route-based IPsec VPN).

  • Site-to-Site IPsec VPN.

  • Dialup IPsec VPN. The FortiGate-7000F can be the dialup server or client.

  • Static and dynamic routing (BGP, OSPF, and RIP) over IPsec VPN tunnels.

  • When an IPsec VPN tunnel is initialized, the SA is synchronized to all FPMs in the FortiGate-7000F, or in both FortiGate-7000Fs in an HA configuration.

  • Traffic between IPsec VPN tunnels is supported when both tunnels terminate on the same FPM.

  • When setting up a VRF configuration to send traffic between two IPsec VPN interfaces with different VRFs, both IPsec tunnels must terminate on the same FPM. Use the ipsec-tunnel-slot option in each IPsec VPN phase 1-interface configuration to terminate both phase 1s on the same FPM.

  • The FortiGate-7000F, because it uses NP7 processors for SLBC, supports IPsec VPN to remote networks with 0- to 15-bit netmasks.

FortiGate-7000F IPsec VPN has the following limitations:

  • Policy-based IPsec VPN tunnels terminated by the FortiGate-7000F are not supported.

  • Policy routes cannot be used for communication over IPsec VPN tunnels.

  • IPv6 clear-text traffic (IPv6 over IPv4 or IPv6 over IPv6) is not supported.

  • IPsec SA synchronization between FGSP HA peers is not supported.

  • When setting up an IPsec VPN VLAN interface, do not set the VLAN ID to 1. This VLAN ID is reserved by FortiOS. Any configurations that use a VLAN with VLAN ID = 1 will not work as expected.