IPsec VPN in an HA environment

This is a sample configuration of site-to-site IPsec VPN in an HA environment.

For this example, set up HA as described in the HA topics. When setting up HA, enable the following options to ensure IPsec VPN traffic is not interrupted during an HA failover:

• session-pickup under HA settings.
• ha-sync-esp-seqno under IPsec phase1-interface settings.

You can configure IPsec VPN in an HA environment using the GUI or CLI.

In this example, the VPN name for HQ1 is "to_HQ2", and the VPN name for HQ2 is "to_HQ1".

To configure IPsec VPN in an HA environment in the GUI:

1. Set up IPsec VPN on HQ1 (the HA cluster):
   1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
      1. Enter a VPN name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, set No NAT between sites.
      5. Click Next.
   2. Configure the following settings for Authentication:
      1. For Remote Device, select IP Address.
      2. In the IP address field, enter 172.16.202.1.
      3. For Outgoing Interface, select port1.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter an example key.
      6. Click Next.
   3. Configure the following settings for Policy & Routing:
      1. From the Local Interface dropdown menu, select the local interface.
      2. Configure the Local Subnets as 10.1.100.0/24.
      3. Configure the Remote Subnets as 172.16.101.0/24.
      4. Click Create.
2. Set up IPsec VPN on HQ2:
   1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
      1. Enter a VPN name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiGate.
      4. For NAT Configuration, set No NAT between sites.
      5. Click Next.
   2. Configure the following settings for Authentication:
      1. For Remote Device, select IP Address.
      2. In the IP address field, enter 172.16.200.1.
      3. For Outgoing Interface, select port13.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter an example key.
      6. Click Next.
   3. Configure the following settings for Policy & Routing:
      1. From the Local Interface dropdown menu, select the desired local interface. In this example, it is port9.
      2. Configure the Local Subnets as 172.16.101.0.
      3. Configure the Remote Subnets as 10.1.100.0
      4. Click Create.

To configure IPsec VPN in an HA environment using the CLI:

1. Configure HA. In this example, two FortiGates work in active-passive mode. The HA heartbeat interfaces are WAN1 and WAN2:

   config system ha

   set group-name "FGT-HA"

   set mode a-p

   set password sample

   set hbdev "wan1" 50 "wan2" 50

   set session-pickup enable

   set priority 200

   set override-wait-time 10

   end

2. Configure the WAN interface and default route. The WAN interface is the interface connected to the ISP. It can work in static mode (as shown in this example), DHCP, or PPPoE mode. The IPsec tunnel is established over the WAN interface.
   1. Configure HQ1:

      config system interface

      edit "port1"

      set vdom "root"

      set ip 172.16.200.1 255.255.255.0

      next

      end

      config router static

      edit 1

      set gateway 172.16.200.3

      set device "port1"

      next

      end

   2. Configure HQ2:

      config system interface

      edit "port25"

      set vdom "root"

      set ip 172.16.202.1 255.255.255.0

      next

      end

      config router static

      edit 1

      set gateway 172.16.202.2

      set device "port25"

      next

      end

3. Configure the internal (protected subnet) interface. The internal interface connects to the corporate internal network. Traffic from this interface routes out the IPsec VPN tunnel.
   1. Configure HQ1:

      config system interface

      edit "dmz"

      set vdom "root"

      set ip 10.1.100.1 255.255.255.0

      next

      end

   2. Configure HQ2:

      config system interface

      edit "port9"

      set vdom "root"

      set ip 172.16.101.1 255.255.255.0

      next

      end

4. Configure the IPsec phase1-interface. This example uses PSK as the authentication method. You can also use signature authentication.
   1. Configure HQ1:

      config vpn ipsec phase1-interface

      edit "to_HQ2"

      set interface "port1"

      set peertype any

      set net-device enable

      set ha-sync-esp-seqno enable

      set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

      set remote-gw 172.16.202.1

      set psksecret sample

      next

      end

   2. Configure HQ2:

      config vpn ipsec phase1-interface

      edit "to_HQ1"

      set interface "port25"

      set peertype any

      set net-device enable

      set ha-sync-esp-seqno enable

      set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

      set remote-gw 172.16.200.1

      set psksecret sample

      next

5. Configure the IPsec phase2-interface:
   1. Configure HQ1:

      config vpn ipsec phase2-interface

      edit "to_HQ2"

      set phase1name "to_HQ2"

      set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

      set auto-negotiate enable

      next

      end

   2. Configure HQ2:

      config vpn ipsec phase2-interface

      edit "to_HQ1"

      set phase1name "to_HQ1"

      set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

      set auto-negotiate enable

      next

      end

6. Configure static routes. Two static routes are added to reach the remote protected subnet. The blackhole route is important to ensure IPsec traffic does not match the default route when the IPsec tunnel is down.
   1. Configure HQ1:

      config router static

      edit 2

      set dst 172.16.101.0 255.255.255.0

      set device "to_HQ2"

      next

      edit 3

      set dst 172.16.101.0 255.255.255.0

      set blackhole enable

      set distance 254

      next

      end

   2. Configure HQ2:

      config router static

      edit 2

      set dst 10.1.100.0 255.255.255.0

      set device "to_HQ1"

      next

      edit 3

      set dst 10.1.100.0 255.255.255.0

      set blackhole enable

      set distance 254

      next

      end

7. Configure two firewall policies to allow bi-directional IPsec traffic flow over the IPsec tunnel:
   1. Configure HQ1:

      config firewall policy

      edit 1

      set name "inbound"

      set srcintf "to_HQ2"

      set dstintf "dmz"

      set srcaddr "172.16.101.0"

      set dstaddr "10.1.100.0"

      set action accept

      set schedule "always"

      set service "ALL"

      next

      edit 2

      set name "outbound"

      set srcintf "dmz"

      set dstintf "to_HQ2"

      set srcaddr "10.1.100.0"

      set dstaddr "172.16.101.0"

      set action accept

      set schedule "always"

      set service "ALL"

      next

      end

   2. Configure HQ2:

      config firewall policy

      edit 1

      set name "inbound"

      set srcintf "to_HQ1"

      set dstintf "port9"

      set srcaddr "10.1.100.0"

      set dstaddr "172.16.101.0"

      set action accept

      set schedule "always"

      set service "ALL"

      next

      edit 2

      set name "outbound"

      set srcintf "port9"

      set dstintf "to_HQ1"

      set srcaddr "172.16.101.0"

      set dstaddr "10.1.100.0"

      set action accept

      set schedule "always"

      set service "ALL"

      next

      end

8. Use the following diagnose commands to check IPsec phase1/phase2 interface status including the sequence number on the secondary FortiGate. The diagnose debug application ike -1 command is the key to troubleshoot why the IPsec tunnel failed to establish.
   1. Run the HQ1 # diagnose vpn ike gateway list command. The system should return the following:

      vd: root/0

      name: to_HQ2

      version: 1

      interface: port1 11

      addr: 172.16.200.1:500 -> 172.16.202.1:500

      created: 5s ago

      IKE SA: created 1/1 established 1/1 time 0/0/0 ms

      IPsec SA: created 2/2 established 2/2 time 0/0/0 ms

      id/spi: 12 6e8d0532e7fe8d84/3694ac323138a024 direction: responder status: established 5-5s ago = 0ms proposal: aes128-sha256 key: b3efb46d0d385aff-7bb9ee241362ee8d lifetime/rekey: 86400/86124 DPD sent/recv: 00000000/00000000

   2. Run the HQ1 # diagnose vpn tunnel list command. The system should return the following:

      list all ipsec tunnel in vd 0

      name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0

      bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1

      proxyid_num=1 child_num=0 refcnt=11 ilast=7 olast=87 ad=/0

      stat: rxp=0 txp=0 rxb=0 txb=0

      dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0

      natt: mode=none draft=0 interval=0 remote_port=0

      proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate

      src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=42927/0B replaywin=2048

      seqno=1 esn=0 replaywin_lastseq=00000000 itn=0

      life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7

      ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b

      enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a

      ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3

      dec:pkts/bytes=0/0, enc:pkts/bytes=0/0

      ESP seqno synced to primary FortiGate every five minutes, and big gap between primary and secondary to ensure that no packet is dropped after HA failover caused by tcp-replay. Check ESP sequence number synced on secondary FortiGate.

   3. Run the HQ1 # execute ha manage 0 admin command.
   4. Run the HQ1-Secondary # diagnose vpn tunnel list command. The system should return the following:

      list all ipsec tunnel in vd 0

      name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0

      bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1

      proxyid_num=1 child_num=0 refcnt=11 ilast=13 olast=274 ad=/0

      stat: rxp=0 txp=0 rxb=0 txb=0

      dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0

      natt: mode=none draft=0 interval=0 remote_port=0

      proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate

      src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=27 type=00 soft=0 mtu=1280 expire=42740/0B replaywin=2048

      seqno=47868c01 esn=0 replaywin_lastseq=00000000 itn=0

      life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7

      ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b

      enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a

      ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3

      dec:pkts/bytes=0/0, enc:pkts/bytes=0/0