IPsec VPN authenticating a remote FortiGate peer with a pre-shared key

This is a sample configuration of IPsec VPN authenticating a remote FortiGate peer with a pre-shared key.

To configure IPsec VPN authenticating a remote FortiGate peer with a pre-shared key in the GUI:

1. Configure the HQ1 FortiGate.
   1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
      1. Enter a VPN name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, select No NAT Between Sites.
      5. Click Next.
   2. Configure the following settings for Authentication:
      1. For Remote Device, select IP Address.
      2. For the IP address, enter 172.16.202.1.
      3. For Outgoing interface, enter port1.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter sample as the key.
      6. Click Next.
   3. Configure the following settings for Policy & Routing:
      1. From the Local Interface dropdown menu, select the local interface.
      2. Configure the Local Subnets as 10.1.100.0.
      3. Configure the Remote Subnets as 172.16.101.0.
      4. Click Create.
2. Configure the HQ2 FortiGate.
   1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
      1. Enter a VPN name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, select No NAT Between Sites.
      5. Click Next.
   2. Configure the following settings for Authentication:
      1. For Remote Device, select IP Address.
      2. For the IP address, enter 172.16.2001.
      3. For Outgoing interface, enter port25.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter sample as the key.
      6. Click Next.
   3. Configure the following settings for Policy & Routing:
      1. From the Local Interface dropdown menu, select the local interface.
      2. Configure Local Subnets as 172.16.101.0.
      3. Configure the Remote Subnets as 10.1.100.0.
      4. Click Create.

To configure IPsec VPN authenticating a remote FortiGate peer with a pre-shared key using the CLI:

1. Configure the WAN interface and default route. The WAN interface is the interface connected to the ISP. The IPsec tunnel is established over the WAN interface.
   1. Configure HQ1.

      config system interface 
          edit "port1"
              set vdom "root"
              set ip 172.16.200.1 255.255.255.0
          next
      end
      config router static
          edit 1
              set gateway 172.16.200.3
              set device "port1"
          next
      end

   2. Configure HQ2.

      config system interface
          edit "port25"
              set vdom "root"
              set ip 172.16.202.1 255.255.255.0
          next
      end
      config router static
          edit 1
              set gateway 172.16.202.2
              set device "port25"
          next
      end

2. Configure the internal (protected subnet) interface. The internal interface connects to the corporate internal network. Traffic from this interface routes out the IPsec VPN tunnel.
   1. Configure HQ1.

      config system interface
          edit "dmz"
              set vdom "root"
              set ip 10.1.100.1 255.255.255.0
          next
      end

   2. Configure HQ2.

      config system interface
          edit "port9"
              set vdom "root"
              set ip 172.16.101.1 255.255.255.0
          next
      end 

3. Configure the IPsec phase1-interface.
   1. Configure HQ1.

      config vpn ipsec phase1-interface
          edit "to_HQ2"
              set interface "port1"
              set peertype any
              set net-device enable
              set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
              set remote-gw 172.16.202.1
              set psksecret sample
          next
      end

   2. Configure HQ2.

      config vpn ipsec phase1-interface
          edit "to_HQ1" 
              set interface "port25"
              set peertype any
              set net-device enable
              set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
              set remote-gw 172.16.200.1
              set psksecret  sample
          next
      end

4. Configure the IPsec phase2-interface.
   1. Configure HQ1.

      config vpn ipsec phase2-interface
          edit "to_HQ2"
              set phase1name "to_HQ2"
              set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
              set auto-negotiate enable
          next
      end

   2. Configure HQ2.

      config vpn ipsec phase2-interface
          edit "to_HQ2"
              set phase1name "to_HQ1"
              set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
              set auto-negotiate enable
          next
      end

5. Configure the static routes. Two static routes are added to reach the remote protected subnet. The blackhole route is important to ensure that IPsec traffic does not match the default route when the IPsec tunnel is down.
   1. Configure HQ1.

      config router static
          edit 2
              set dst 172.16.101.0 255.255.255.0
              set device "to_HQ2"
          next
          edit 3
              set dst 172.16.101.0 255.255.255.0
              set blackhole enable
              set distance 254
          next
      end

   2. Configure HQ2.

      config router static
          edit 2
              set dst 10.1.100.0 255.255.255.0
              set device "to_HQ1"
          next
          edit 3
              set dst 10.1.100.0 255.255.255.0
              set blackhole enable
              set distance 254
           next
      end

6. Configure two firewall policies to allow bidirectional IPsec traffic flow over the IPsec VPN tunnel.
   1. Configure HQ1.

      config firewall policy
          edit 1
              set name "inbound"
              set srcintf "to_HQ2"
              set dstintf "dmz"
              set srcaddr "172.16.101.0"
              set dstaddr "10.1.100.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
          edit 2
              set name "outbound"
              set srcintf "dmz"
              set dstintf "to_HQ2"
              set srcaddr "10.1.100.0"
              set dstaddr "172.16.101.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
      end

   2. Configure HQ2.

      config firewall policy
          edit 1
              set name "inbound"
              set srcintf "to_HQ1"
              set dstintf "port9"
              set srcaddr "10.1.100.0"
              set dstaddr "172.16.101.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
          edit 2
              set name "outbound"
              set srcintf "port9"
              set dstintf "to_HQ1"
              set srcaddr "172.16.101.0"
              set dstaddr "10.1.100.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
      end

7. Run diagnose commands. The diagnose debug application ike -1 command is the key to troubleshoot why the IPsec tunnel failed to establish. If the PSK failed to match, the following error shows up in the debug output:

   ike 0:to_HQ2:15037: parse error
   ike 0:to_HQ2:15037: probable pre-shared secret mismatch'

   The following commands are useful to check IPsec phase1/phase2 interface status.

   1. Run the diagnose vpn ike gateway list command on HQ1. The system should return the following:

      vd: root/0
      name: to_HQ2
      version: 1
      interface: port1 11
      addr: 172.16.200.1:500 -> 172.16.202.1:500
      created: 5s ago
      IKE SA: created 1/1 established 1/1 time 0/0/0 ms
      IPsec SA: created 2/2 established 2/2 time 0/0/0 ms
      id/spi: 12 6e8d0532e7fe8d84/3694ac323138a024
      direction: responder
      status: established 5-5s ago = 0ms
      proposal: aes128-sha256
      key: b3efb46d0d385aff-7bb9ee241362ee8d
      lifetime/rekey: 86400/86124
      DPD sent/recv: 00000000/00000000

   2. Run the diagnose vpn tunnel list command on HQ1. The system should return the following:

      list all ipsec tunnel in vd 0
      name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0
      bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfcaccept_traffic=1
      proxyid_num=1 child_num=0 refcnt=11 ilast=7 olast=87 ad=/0
      stat: rxp=0 txp=0 rxb=0 txb=0
      dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0
      natt: mode=none draft=0 interval=0 remote_port=0
      proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate
      src: 0:0.0.0.0/0.0.0.0:0
      dst: 0:0.0.0.0/0.0.0.0:0
      SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=42927/0B replaywin=2048
      seqno=1 esn=0 replaywin_lastseq=00000000 itn=0
      life: type=01 bytes=0/0 timeout=42930/43200
      dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7
      ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b
      enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a
      ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3
      dec:pkts/bytes=0/0, enc:pkts/bytes=0/0