Fortinet Document Library

Version:


Table of Contents

AliCloud Administration Guide

6.4.0
Download PDF
Copy Link

Connecting a local FortiGate to an AliCloud FortiGate via site-to-site VPN

This guide provides sample configuration of a site-to-site VPN connection from a local FortiGate to an AliCloud FortiGate via site-to-site IPsec VPN with static routing. The following depicts the network topology for this sample deployment:

The following prerequisites must be met for this configuration:

  • A FortiGate located on AliCloud with port1 connected to local LAN and a public IP address mapped to port1.
  • A local FortiGate in a local environment. Determine if your FortiGate has a publicly accessible IP address or if it is behind NAT. In this example, the on-premise FortiGate is behind NAT.

This recipe consists of the following steps:

  1. Configure the local FortiGate.
  2. Configure the AliCloud FortiGate.
  3. Establish a VPN connection between the local and AliCloud FortiGates.
  4. Run diagnose commands.

Configuring the local FortiGate

To configure the local FortiGate using the GUI:
  1. Configure the interfaces:
    1. In FortiOS, go to Network > Interfaces.
    2. Edit port1. From the Role dropdown list, select WAN. In the IP/Network Mask field, enter 10.6.30.194/255.255.255.0 for the interface that is connected to the Internet.
    3. Edit port4. From the Role dropdown list, select LAN. In the IP/Network Mask field, enter 192.168.4.194/255.255.255.0 for the interface that is connected to the local subnet.
  2. Configure a static route to connect to the Internet:
    1. Go to Network > Static Routes.
    2. Click Create New.
    3. In the Destination field, enter 0.0.0.0/0.0.0.0.
    4. From the Interface dropdown list, select port1.
    5. In the Gateway Address field, enter 10.6.30.254.
  3. Configure IPsec VPN:
    1. Go to VPN > IPsec Wizard.
    2. Configure VPN Setup:
      1. In the Name field, enter the desired name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, select This site is behind NAT. Click Next. For non-dialup situations where the local FortiGate has an external IP address, select No NAT between sites.
    3. Configure Authentication:
      1. For Remote Device, select IP Address.
      2. In the IP Address field, enter 47.254.43.106. This is the AliCloud FortiGate port1 public IP address.
      3. From the Outgoing Interface dropdown list, select port1.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter 123456. Click Next.
    4. Configure Policy & Routing:
      1. From the Local Interface dropdown list, select port4. This autofills the Local Subnets field with 192.168.4.0/24.
      2. In the Remote Subnets field, enter 192.168.4.0/24. This is the AliCloud FortiGate port1 subnet.
      3. For Internet Access, select None. Click Create.
To configure the local FortiGate using the CLI:
  1. Configure the interfaces:

    config system interface edit "port1" set vdom "root" set ip 10.6.30.194 255.255.255.0 set allowaccess ping https ssh http fgfm set type physical set role wan set snmp-index 1 next edit "port4 set vdom "root" set ip 192.168.4.194 255.255.255.0 set allowaccess ping https ssh snmp fgfm ftm set type physical set device-identification enable set lldp-transmission enable set role lan set snmp-index 4 next end

  2. Configure a static route to connect to the Internet:

    config router static edit 1 set gateway 10.6.30.254 set device "port1" next end

  3. Configure IPsec VPN:

    config vpn ipsec phase1-interface edit "to_ali" set interface "port1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set comments "VPN: to_ali (Created by VPN wizard)" set wizard-type static-fortigate set remote-gw 47.254.43.106 set psksecret xxxxxx next end config vpn ipsec phase2-interface edit "to_ali" set phase1name "to_ali" set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305 set comments "VPN: to_ali (Created by VPN wizard)" set src-addr-type name set dst-addr-type name set src-name "to_ali_local" set dst-name "to_ali_remote" next end config router static edit 2 set device "to_ali" set comment "VPN: to_ali (Created by VPN wizard)" set dstaddr "to_ali_remote" next edit 3 set distance 254 set comment "VPN: to_ali (Created by VPN wizard)" set blackhole enable set dstaddr "to_ali_remote" next end config firewall policy edit 1 set name "vpn_to_ali_local" set uuid c6b2d36e-6c65-51e9-5a78-9a0881a0b07c set srcintf "port4" set dstintf "to_ali" set srcaddr "to_ali_local" set dstaddr "to_ali_remote" set action accept set schedule "always" set service "ALL" set comments "VPN: to_ali (Created by VPN wizard)" next edit 2 set name "vpn_to_ali_remote" set uuid c6bf126e-6c65-51e9-8652-cb88546929b4 set srcintf "to_ali" set dstintf "port4" set srcaddr "to_ali_remote" set dstaddr "to_ali_local" set action accept set schedule "always" set service "ALL" set comments "VPN: to_ali (Created by VPN wizard)" next end

Configuring the AliCloud FortiGate

To configure the AliCloud FortiGate using the GUI:
  1. Configure the interface:
    1. In FortiOS, go to Network > Interfaces.
    2. Edit port1.
    3. From the Role dropdown list, select LAN.
    4. Ensure that Addressing mode is set to DHCP and that the FortiGate can list the assigned IP address.
  2. Configure IPsec VPN:
    1. Go to VPN > IPsec Wizard.
    2. Configure VPN Setup:
      1. In the Name field, enter the desired name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, select The remote site is behind NAT. Click Next.
    3. Configure Authentication:
      1. From the Incoming Interface dropdown list, select port1.
      2. For Authentication Method, select Pre-shared Key.
      3. In the Pre-shared Key field, enter 123456. Click Next.
    4. Configure Policy & Routing:
      1. From the Local Interface dropdown list, select port1. This autofills the Local Subnets field with 192.168.4.0/24.
      2. In the Remote Subnets field, enter 192.168.4.0/24. This is the local FortiGate port4 subnet.
      3. For Internet Access, select None. Click Create.
To configure the AliCloud FortiGate using the CLI:
  1. Configure the interface and ensure that the FortiGate can list the assigned IP address:

    config system interface edit "port1" set vdom "root" set mode dhcp set allowaccess ping https ssh fgfm set type physical set device-identification enable set lldp-transmission enable set role lan set snmp-index 1 next end

    diagnose ip address list IP=192.168.0.177->192.168.0.177/255.255.255.0 index=3 devname=port1

  2. Configure IPsec VPN:

    config vpn ipsec phase1-interface edit "to_local" set type dynamic set interface "port1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set dpd on-idle set comments "VPN: to_local (Created by VPN wizard)" set wizard-type dialup-fortigate set psksecret xxxxxx set dpd-retryinterval 60 next end config vpn ipsec phase2-interface edit "to_local" set phase1name "to_local" set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305 set comments "VPN: to_local (Created by VPN wizard)" set src-addr-type name set dst-addr-type name set src-name "to_local_local" set dst-name "to_local_remote" next end config firewall policy edit 1 set name "vpn_to_local_local" set uuid e07aaa72-833c-51e9-ad33-4c1e96b656da set srcintf "port1" set dstintf "to_local" set srcaddr "to_local_local" set dstaddr "to_local_remote" set action accept set schedule "always" set service "ALL" set comments "VPN: to_local (Created by VPN wizard)" next edit 2 set name "vpn_to_local_remote" set uuid e086b2b8-833c-51e9-3aaf-49e3cd4c5c70 set srcintf "to_local" set dstintf "port1" set srcaddr "to_local_remote" set dstaddr "to_local_local" set action accept set schedule "always" set service "ALL" set comments "VPN: to_local (Created by VPN wizard)" next end

To establish the VPN connection between the FortiGates:

The tunnel is down until you initiate connection from the local FortiGate.

  1. In FortiOS on the local FortiGate, go to Monitor > IPsec Monitor.
  2. Click the created tunnel.
  3. Click Bring Up. The tunnel is up.

  4. In FortiOS on the AliCloud FortiGate, go to Monitor > IPsec Monitor to verify that the tunnel is up.

To run diagnose commands:
  1. Show the local FortiGate VPN status:

    FGT-194-Level1 # diagnose vpn ike gateway list vd: root/0 name: to_ali version: 1 interface: port1 3 addr: 10.6.30.194:4500 -> 47.254.43.106:4500 created: 4057s ago nat: me peer IKE SA: created 1/1 established 1/1 time 21180/21180/21180 ms IPsec SA: created 1/3 established 1/3 time 20/26/30 ms id/spi: 2 fd018d163ea303aa/9d7a245f889ee6c4 direction: initiator status: established 4057-4036s ago = 21180ms proposal: aes128-sha256 key: c7bab4dd8883b727-3b249220088216f8 lifetime/rekey: 86400/82063 DPD sent/recv: 00000000/00000009 FGT-194-Level1 # diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=to_ali ver=1 serial=1 10.6.30.194:4500->47.254.43.106:4500 dst_mtu=1500 bound_if=3 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1 proxyid_num=1 child_num=0 refcnt=14 ilast=0 olast=0 ad=/0 stat: rxp=3382 txp=3404 rxb=432896 txb=204240 dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0 natt: mode=keepalive draft=32 interval=10 remote_port=4500 proxyid=to_ali proto=0 sa=1 ref=2 serial=3 src: 0:192.168.4.0/255.255.255.0:0 dst: 0:192.168.0.0/255.255.255.0:0 SA: ref=3 options=10226 type=00 soft=0 mtu=1422 expire=39471/0B replaywin=2048 seqno=d14 esn=0 replaywin_lastseq=00000d0d itn=0 qat=0 life: type=01 bytes=0/0 timeout=42903/43200 dec: spi=8427ce41 esp=aes key=16 961323608ef02c111ce4cc393cd79293 ah=sha1 key=20 9cffabaa0163df6a92e1917efa333148b58ff9da enc: spi=e2723047 esp=aes key=16 f93b233906039c179924923a4f09ebae ah=sha1 key=20 c2c6225e26927de6381bf44c6ccd6d0a325e2e27 dec:pkts/bytes=3325/199500, enc:pkts/bytes=3347/428416

  2. Show the AliCloud FortiGate VPN status:

    FGT-ALIONDEMAND # diagnose vpn ike gateway list vd: root/0 name: to_local_0 version: 1 interface: port1 3 addr: 192.168.0.177:4500 -> 208.91.114.1:64916 created: 4103s ago nat: me peer IKE SA: created 1/1 established 1/1 time 120/120/120 ms IPsec SA: created 1/3 established 1/3 time 20/26/30 ms id/spi: 0 fd018d163ea303aa/9d7a245f889ee6c4 direction: responder status: established 4103-4103s ago = 120ms proposal: aes128-sha256 key: c7bab4dd8883b727-3b249220088216f8 lifetime/rekey: 86400/82026 DPD sent/recv: 00000009/00000000 FGT-ALIONDEMAND # diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=to_local ver=1 serial=1 192.168.0.177:0->0.0.0.0:0 dst_mtu=0 bound_if=3 lgwy=static/1 tun=intf/0 mode=dialup/2 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1 proxyid_num=0 child_num=1 refcnt=11 ilast=4118 olast=4118 ad=/0 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=on-idle on=0 idle=60000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 ------------------------------------------------------ name=to_local_0 ver=1 serial=2 192.168.0.177:4500->208.91.114.1:64916 dst_mtu=1500 bound_if=3 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/976 options[03d0]=create_dev no-sysctl rgwy-chg rport-chg frag-rfc accept_traffic=1 parent=to_local index=0 proxyid_num=1 child_num=0 refcnt=14 ilast=0 olast=0 ad=/0 stat: rxp=3459 txp=3459 rxb=442752 txb=207540 dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=9 natt: mode=keepalive draft=32 interval=10 remote_port=64916 proxyid=to_local proto=0 sa=1 ref=2 serial=3 add-route src: 0:192.168.0.0/255.255.255.0:0 dst: 0:192.168.4.0/255.255.255.0:0 SA: ref=3 options=282 type=00 soft=0 mtu=1422 expire=39694/0B replaywin=2048 seqno=d4b esn=0 replaywin_lastseq=00000d52 itn=0 qat=0 life: type=01 bytes=0/0 timeout=43187/43200 dec: spi=e2723047 esp=aes key=16 f93b233906039c179924923a4f09ebae ah=sha1 key=20 c2c6225e26927de6381bf44c6ccd6d0a325e2e27 enc: spi=8427ce41 esp=aes key=16 961323608ef02c111ce4cc393cd79293 ah=sha1 key=20 9cffabaa0163df6a92e1917efa333148b58ff9da dec:pkts/bytes=3402/204120, enc:pkts/bytes=3402/435456

Connecting a local FortiGate to an AliCloud FortiGate via site-to-site VPN

This guide provides sample configuration of a site-to-site VPN connection from a local FortiGate to an AliCloud FortiGate via site-to-site IPsec VPN with static routing. The following depicts the network topology for this sample deployment:

The following prerequisites must be met for this configuration:

  • A FortiGate located on AliCloud with port1 connected to local LAN and a public IP address mapped to port1.
  • A local FortiGate in a local environment. Determine if your FortiGate has a publicly accessible IP address or if it is behind NAT. In this example, the on-premise FortiGate is behind NAT.

This recipe consists of the following steps:

  1. Configure the local FortiGate.
  2. Configure the AliCloud FortiGate.
  3. Establish a VPN connection between the local and AliCloud FortiGates.
  4. Run diagnose commands.

Configuring the local FortiGate

To configure the local FortiGate using the GUI:
  1. Configure the interfaces:
    1. In FortiOS, go to Network > Interfaces.
    2. Edit port1. From the Role dropdown list, select WAN. In the IP/Network Mask field, enter 10.6.30.194/255.255.255.0 for the interface that is connected to the Internet.
    3. Edit port4. From the Role dropdown list, select LAN. In the IP/Network Mask field, enter 192.168.4.194/255.255.255.0 for the interface that is connected to the local subnet.
  2. Configure a static route to connect to the Internet:
    1. Go to Network > Static Routes.
    2. Click Create New.
    3. In the Destination field, enter 0.0.0.0/0.0.0.0.
    4. From the Interface dropdown list, select port1.
    5. In the Gateway Address field, enter 10.6.30.254.
  3. Configure IPsec VPN:
    1. Go to VPN > IPsec Wizard.
    2. Configure VPN Setup:
      1. In the Name field, enter the desired name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, select This site is behind NAT. Click Next. For non-dialup situations where the local FortiGate has an external IP address, select No NAT between sites.
    3. Configure Authentication:
      1. For Remote Device, select IP Address.
      2. In the IP Address field, enter 47.254.43.106. This is the AliCloud FortiGate port1 public IP address.
      3. From the Outgoing Interface dropdown list, select port1.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter 123456. Click Next.
    4. Configure Policy & Routing:
      1. From the Local Interface dropdown list, select port4. This autofills the Local Subnets field with 192.168.4.0/24.
      2. In the Remote Subnets field, enter 192.168.4.0/24. This is the AliCloud FortiGate port1 subnet.
      3. For Internet Access, select None. Click Create.
To configure the local FortiGate using the CLI:
  1. Configure the interfaces:

    config system interface edit "port1" set vdom "root" set ip 10.6.30.194 255.255.255.0 set allowaccess ping https ssh http fgfm set type physical set role wan set snmp-index 1 next edit "port4 set vdom "root" set ip 192.168.4.194 255.255.255.0 set allowaccess ping https ssh snmp fgfm ftm set type physical set device-identification enable set lldp-transmission enable set role lan set snmp-index 4 next end

  2. Configure a static route to connect to the Internet:

    config router static edit 1 set gateway 10.6.30.254 set device "port1" next end

  3. Configure IPsec VPN:

    config vpn ipsec phase1-interface edit "to_ali" set interface "port1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set comments "VPN: to_ali (Created by VPN wizard)" set wizard-type static-fortigate set remote-gw 47.254.43.106 set psksecret xxxxxx next end config vpn ipsec phase2-interface edit "to_ali" set phase1name "to_ali" set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305 set comments "VPN: to_ali (Created by VPN wizard)" set src-addr-type name set dst-addr-type name set src-name "to_ali_local" set dst-name "to_ali_remote" next end config router static edit 2 set device "to_ali" set comment "VPN: to_ali (Created by VPN wizard)" set dstaddr "to_ali_remote" next edit 3 set distance 254 set comment "VPN: to_ali (Created by VPN wizard)" set blackhole enable set dstaddr "to_ali_remote" next end config firewall policy edit 1 set name "vpn_to_ali_local" set uuid c6b2d36e-6c65-51e9-5a78-9a0881a0b07c set srcintf "port4" set dstintf "to_ali" set srcaddr "to_ali_local" set dstaddr "to_ali_remote" set action accept set schedule "always" set service "ALL" set comments "VPN: to_ali (Created by VPN wizard)" next edit 2 set name "vpn_to_ali_remote" set uuid c6bf126e-6c65-51e9-8652-cb88546929b4 set srcintf "to_ali" set dstintf "port4" set srcaddr "to_ali_remote" set dstaddr "to_ali_local" set action accept set schedule "always" set service "ALL" set comments "VPN: to_ali (Created by VPN wizard)" next end

Configuring the AliCloud FortiGate

To configure the AliCloud FortiGate using the GUI:
  1. Configure the interface:
    1. In FortiOS, go to Network > Interfaces.
    2. Edit port1.
    3. From the Role dropdown list, select LAN.
    4. Ensure that Addressing mode is set to DHCP and that the FortiGate can list the assigned IP address.
  2. Configure IPsec VPN:
    1. Go to VPN > IPsec Wizard.
    2. Configure VPN Setup:
      1. In the Name field, enter the desired name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, select The remote site is behind NAT. Click Next.
    3. Configure Authentication:
      1. From the Incoming Interface dropdown list, select port1.
      2. For Authentication Method, select Pre-shared Key.
      3. In the Pre-shared Key field, enter 123456. Click Next.
    4. Configure Policy & Routing:
      1. From the Local Interface dropdown list, select port1. This autofills the Local Subnets field with 192.168.4.0/24.
      2. In the Remote Subnets field, enter 192.168.4.0/24. This is the local FortiGate port4 subnet.
      3. For Internet Access, select None. Click Create.
To configure the AliCloud FortiGate using the CLI:
  1. Configure the interface and ensure that the FortiGate can list the assigned IP address:

    config system interface edit "port1" set vdom "root" set mode dhcp set allowaccess ping https ssh fgfm set type physical set device-identification enable set lldp-transmission enable set role lan set snmp-index 1 next end

    diagnose ip address list IP=192.168.0.177->192.168.0.177/255.255.255.0 index=3 devname=port1

  2. Configure IPsec VPN:

    config vpn ipsec phase1-interface edit "to_local" set type dynamic set interface "port1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set dpd on-idle set comments "VPN: to_local (Created by VPN wizard)" set wizard-type dialup-fortigate set psksecret xxxxxx set dpd-retryinterval 60 next end config vpn ipsec phase2-interface edit "to_local" set phase1name "to_local" set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305 set comments "VPN: to_local (Created by VPN wizard)" set src-addr-type name set dst-addr-type name set src-name "to_local_local" set dst-name "to_local_remote" next end config firewall policy edit 1 set name "vpn_to_local_local" set uuid e07aaa72-833c-51e9-ad33-4c1e96b656da set srcintf "port1" set dstintf "to_local" set srcaddr "to_local_local" set dstaddr "to_local_remote" set action accept set schedule "always" set service "ALL" set comments "VPN: to_local (Created by VPN wizard)" next edit 2 set name "vpn_to_local_remote" set uuid e086b2b8-833c-51e9-3aaf-49e3cd4c5c70 set srcintf "to_local" set dstintf "port1" set srcaddr "to_local_remote" set dstaddr "to_local_local" set action accept set schedule "always" set service "ALL" set comments "VPN: to_local (Created by VPN wizard)" next end

To establish the VPN connection between the FortiGates:

The tunnel is down until you initiate connection from the local FortiGate.

  1. In FortiOS on the local FortiGate, go to Monitor > IPsec Monitor.
  2. Click the created tunnel.
  3. Click Bring Up. The tunnel is up.

  4. In FortiOS on the AliCloud FortiGate, go to Monitor > IPsec Monitor to verify that the tunnel is up.

To run diagnose commands:
  1. Show the local FortiGate VPN status:

    FGT-194-Level1 # diagnose vpn ike gateway list vd: root/0 name: to_ali version: 1 interface: port1 3 addr: 10.6.30.194:4500 -> 47.254.43.106:4500 created: 4057s ago nat: me peer IKE SA: created 1/1 established 1/1 time 21180/21180/21180 ms IPsec SA: created 1/3 established 1/3 time 20/26/30 ms id/spi: 2 fd018d163ea303aa/9d7a245f889ee6c4 direction: initiator status: established 4057-4036s ago = 21180ms proposal: aes128-sha256 key: c7bab4dd8883b727-3b249220088216f8 lifetime/rekey: 86400/82063 DPD sent/recv: 00000000/00000009 FGT-194-Level1 # diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=to_ali ver=1 serial=1 10.6.30.194:4500->47.254.43.106:4500 dst_mtu=1500 bound_if=3 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1 proxyid_num=1 child_num=0 refcnt=14 ilast=0 olast=0 ad=/0 stat: rxp=3382 txp=3404 rxb=432896 txb=204240 dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0 natt: mode=keepalive draft=32 interval=10 remote_port=4500 proxyid=to_ali proto=0 sa=1 ref=2 serial=3 src: 0:192.168.4.0/255.255.255.0:0 dst: 0:192.168.0.0/255.255.255.0:0 SA: ref=3 options=10226 type=00 soft=0 mtu=1422 expire=39471/0B replaywin=2048 seqno=d14 esn=0 replaywin_lastseq=00000d0d itn=0 qat=0 life: type=01 bytes=0/0 timeout=42903/43200 dec: spi=8427ce41 esp=aes key=16 961323608ef02c111ce4cc393cd79293 ah=sha1 key=20 9cffabaa0163df6a92e1917efa333148b58ff9da enc: spi=e2723047 esp=aes key=16 f93b233906039c179924923a4f09ebae ah=sha1 key=20 c2c6225e26927de6381bf44c6ccd6d0a325e2e27 dec:pkts/bytes=3325/199500, enc:pkts/bytes=3347/428416

  2. Show the AliCloud FortiGate VPN status:

    FGT-ALIONDEMAND # diagnose vpn ike gateway list vd: root/0 name: to_local_0 version: 1 interface: port1 3 addr: 192.168.0.177:4500 -> 208.91.114.1:64916 created: 4103s ago nat: me peer IKE SA: created 1/1 established 1/1 time 120/120/120 ms IPsec SA: created 1/3 established 1/3 time 20/26/30 ms id/spi: 0 fd018d163ea303aa/9d7a245f889ee6c4 direction: responder status: established 4103-4103s ago = 120ms proposal: aes128-sha256 key: c7bab4dd8883b727-3b249220088216f8 lifetime/rekey: 86400/82026 DPD sent/recv: 00000009/00000000 FGT-ALIONDEMAND # diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=to_local ver=1 serial=1 192.168.0.177:0->0.0.0.0:0 dst_mtu=0 bound_if=3 lgwy=static/1 tun=intf/0 mode=dialup/2 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1 proxyid_num=0 child_num=1 refcnt=11 ilast=4118 olast=4118 ad=/0 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=on-idle on=0 idle=60000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 ------------------------------------------------------ name=to_local_0 ver=1 serial=2 192.168.0.177:4500->208.91.114.1:64916 dst_mtu=1500 bound_if=3 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/976 options[03d0]=create_dev no-sysctl rgwy-chg rport-chg frag-rfc accept_traffic=1 parent=to_local index=0 proxyid_num=1 child_num=0 refcnt=14 ilast=0 olast=0 ad=/0 stat: rxp=3459 txp=3459 rxb=442752 txb=207540 dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=9 natt: mode=keepalive draft=32 interval=10 remote_port=64916 proxyid=to_local proto=0 sa=1 ref=2 serial=3 add-route src: 0:192.168.0.0/255.255.255.0:0 dst: 0:192.168.4.0/255.255.255.0:0 SA: ref=3 options=282 type=00 soft=0 mtu=1422 expire=39694/0B replaywin=2048 seqno=d4b esn=0 replaywin_lastseq=00000d52 itn=0 qat=0 life: type=01 bytes=0/0 timeout=43187/43200 dec: spi=e2723047 esp=aes key=16 f93b233906039c179924923a4f09ebae ah=sha1 key=20 c2c6225e26927de6381bf44c6ccd6d0a325e2e27 enc: spi=8427ce41 esp=aes key=16 961323608ef02c111ce4cc393cd79293 ah=sha1 key=20 9cffabaa0163df6a92e1917efa333148b58ff9da dec:pkts/bytes=3402/204120, enc:pkts/bytes=3402/435456