Fortinet Document Library

Version:

Version:

Version:


Table of Contents

Cookbook

Download PDF
Copy Link

Configuring the Spoke FortiGates

This example shows the configuration for only one of the spokes. The parameters that need to change for each spoke are in red.

  1. Configure phase 1 parameters.

    config vpn ipsec phase1-interface

    edit "ADVPN"

    set interface "wan1"

    set proposal des-sha1

    set add-route disable

    set dhgrp 2

    set auto-discovery-receiver enable

    set remote-gw 192.0.2.11

    set psksecret fortinet

    next

    end

  2. Configure phase 2 parameters.

    config vpn ipsec phase2-interface

    edit "ADVPN-P2"

    set phase1name "ADVPN"

    set proposal des-sha1

    set auto-negotiate enable

    next

    end

  3. Configure the tunnel interface IP.

    On the spokes, the remote IP is actually used and points to the IP defined on the hub.

    config system interface

    edit "ADVPN"

    set vdom "root"

    set ip 10.10.10.2 255.255.255.255

    set allowaccess ping

    set type tunnel

    set remote-ip 10.10.10.1

    set interface "wan1"

    next

    end

  4. Configure iBGP.

    This is a static standard configuration. You can use redistribution instead of explicit route advertisement.

    config router bgp

    set as 65000

    set router-id 10.10.10.2

    config neighbor

    edit "10.10.10.1"

    set soft-reconfiguration enable

    set remote-as 65000

    set next-hop-self enable

    next

    end

    config network

    edit 0

    set prefix 192.168.2.0 255.255.255.0

    next

    end

    end

  5. Configure a static route for the tunnel IP subnet.

    This step is important for the spokes as they need a summary route that identifies all tunnel IP addresses used in the topology to point to the ADVPN interface. This example uses 10.10.10.0/24 (for networks that expect fewer than 255 sites). Plan this IP range carefully as it is hardcoded in the spokes.

    config router static

    edit 0

    set dst 10.10.10.0 255.255.255.0

    set device "ADVPN"

    next

    end

  6. Configure the following policies.

    config firewall policy

    edit 0

    set name "OUT ADVPN"

    set srcintf "lan"

    set dstintf "ADVPN"

    set srcaddr "all"

    set dstaddr "all"

    set action accept

    set schedule "always"

    set service "ALL"

    set status enable

    next

    edit 0

    set name "IN ADVPN"

    set srcintf "ADVPN"

    set dstintf "lan"

    set srcaddr "all"

    set dstaddr "all"

    set action accept

    set schedule "always"

    set service "ALL"

    set status enable

    next

    end

Configuring the Spoke FortiGates

This example shows the configuration for only one of the spokes. The parameters that need to change for each spoke are in red.

  1. Configure phase 1 parameters.

    config vpn ipsec phase1-interface

    edit "ADVPN"

    set interface "wan1"

    set proposal des-sha1

    set add-route disable

    set dhgrp 2

    set auto-discovery-receiver enable

    set remote-gw 192.0.2.11

    set psksecret fortinet

    next

    end

  2. Configure phase 2 parameters.

    config vpn ipsec phase2-interface

    edit "ADVPN-P2"

    set phase1name "ADVPN"

    set proposal des-sha1

    set auto-negotiate enable

    next

    end

  3. Configure the tunnel interface IP.

    On the spokes, the remote IP is actually used and points to the IP defined on the hub.

    config system interface

    edit "ADVPN"

    set vdom "root"

    set ip 10.10.10.2 255.255.255.255

    set allowaccess ping

    set type tunnel

    set remote-ip 10.10.10.1

    set interface "wan1"

    next

    end

  4. Configure iBGP.

    This is a static standard configuration. You can use redistribution instead of explicit route advertisement.

    config router bgp

    set as 65000

    set router-id 10.10.10.2

    config neighbor

    edit "10.10.10.1"

    set soft-reconfiguration enable

    set remote-as 65000

    set next-hop-self enable

    next

    end

    config network

    edit 0

    set prefix 192.168.2.0 255.255.255.0

    next

    end

    end

  5. Configure a static route for the tunnel IP subnet.

    This step is important for the spokes as they need a summary route that identifies all tunnel IP addresses used in the topology to point to the ADVPN interface. This example uses 10.10.10.0/24 (for networks that expect fewer than 255 sites). Plan this IP range carefully as it is hardcoded in the spokes.

    config router static

    edit 0

    set dst 10.10.10.0 255.255.255.0

    set device "ADVPN"

    next

    end

  6. Configure the following policies.

    config firewall policy

    edit 0

    set name "OUT ADVPN"

    set srcintf "lan"

    set dstintf "ADVPN"

    set srcaddr "all"

    set dstaddr "all"

    set action accept

    set schedule "always"

    set service "ALL"

    set status enable

    next

    edit 0

    set name "IN ADVPN"

    set srcintf "ADVPN"

    set dstintf "lan"

    set srcaddr "all"

    set dstaddr "all"

    set action accept

    set schedule "always"

    set service "ALL"

    set status enable

    next

    end