Security Fabric over IPsec VPN

This is an example of configuring Security Fabric over IPsec VPN.

Sample topology

This sample topology shows a downstream FortiGate (HQ2) connected to the root FortiGate (HQ1) over IPsec VPN to join Security Fabric.

Sample configuration

To configure the root FortiGate (HQ1):

1. Configure interface:
   1. In the root FortiGate (HQ1), go to Network > Interfaces.
   2. Edit port2:
      • Set Role to WAN.
      • For the interface connected to the Internet, set the IP/Network Mask to 10.2.200.1/255.255.255.0
   3. Edit port6:
      • Set Role to DMZ.
      • For the interface connected to FortiAnalyzer, set the IP/Network Mask to 192.168.8.250/255.255.255.0
2. Configure the static route to connect to the Internet:
   1. Go to Network > Static Routes and click Create New or Create New > IPv4 Static Route.
      • Set Destination to 0.0.0.0/0.0.0.0.
      • Set Interface to port2.
      • Set Gateway Address to 10.2.200.2.
   2. Click OK.
3. Configure IPsec VPN:
   1. Go to VPN > IPsec Wizard.
      • Set Name to To-HQ2.
      • Set Template Type to Custom.
      • Click Next.
      • Set Authentication to Method.
      • Set Pre-shared Key to 123456.
   2. Leave all other fields in their default values and click OK.
4. Configure the IPsec VPN interface IP address which will be used to form Security Fabric:
   1. Go to Network > Interfaces.
   2. Edit To-HQ2:
      • Set Role to LAN.
      • Set the IP/Network Mask to 10.10.10.1/255.255.255.255.
      • Set Remote IP/Network Mask to 10.10.10.3/255.255.255.0.
5. Configure IPsec VPN local and remote subnet:
   1. Go to Policy & Objects > Addresses.
   2. Click Create New
      • Set Name to To-HQ2_remote_subnet_2.
      • Set Type to Subnet.
      • Set IP/Network Mask to 10.10.10.3/32.
   3. Click OK.
   4. Click Create New
      • Set Name to To-HQ2_local_subnet_1.
      • Set Type to Subnet.
      • Set IP/Network Mask to 192.168.8.0/24.
   5. Click OK.
   6. Click Create New
      • Set Name to To-HQ2_remote_subnet_1.
      • Set Type to Subnet.
      • Set IP/Network Mask to 10.1.100.0/24.
   7. Click OK.
6. Configure IPsec VPN static routes:
   1. Go to Network > Static Routes
   2. Click Create New or Create New > IPv4 Static Route.
      • For Named Address, select Type and select To-HQ2_remote_subnet_1.
      • Set Interface to To-HQ2.

      Click OK.

   3. Click Create New or Create New > IPv4 Static Route.

      • For Named Address, select Type and select To-HQ2_remote_subnet_1.
      • Set Interface to Blackhole.
      • Set Administrative Distance to 254.
   4. Click OK.
7. Configure IPsec VPN policies:
   1. Go to Policy & Objects > IPv4 Policy
   2. Click Create New.
      • Set Name to vpn_To-HQ2_local.
      • Set Incoming Interface to port6.
      • Set Outgoing Interface to To-HQ2.
      • Set Source to To-HQ2_local_subnet_1.
      • Set Destination to To-HQ2_remote_subnet_1.
      • Set Schedule to Always.
      • Set Service to All.
      • Disable NAT.
   3. Click OK.
   4. Click Create New.
      • Set Name to vpn_To-HQ2_remote.
      • Set Incoming Interface to To-HQ2.
      • Set Outgoing Interface to port6.
      • Set Source to To-HQ2_remote_subnet_1, To-HQ2_remote_subnet_2.
      • Set Destination to To-HQ2_local_subnet_1.
      • Set Schedule to Always.
      • Set Service to All.
      • Enable NAT.
      • Set IP Pool Configuration to Use Outgoing Interface Address.
   5. Click OK.
8. Configure Security Fabric:
   1. Go to Security Fabric > Settings.
   2. Enable FortiGate Telemetry.

      After FortiGate Telemetry is enabled, FortiAnalyzer automatically enables Logging and Upload is set to Real Time.

   3. Set Fabric name to Office-Security-Fabric.
   4. Enable Allow other FortiGates to join and add VPN interface To-HQ2.
   5. Under FortiAnalyzer Logging, set IP address to the FortiAnalyzer IP of 192.168.8.250.
   6. Click Apply.

To configure the downstream FortiGate (HQ2):

1. Configure interface:
   1. Go to Network > Interfaces.
   2. Edit interface wan1:
      • Set Role to WAN.
      • For the interface connected to the Internet, set the IP/Network Mask to 192.168.7.3/255.255.255.0.
   3. Edit interface vlan20:
      • Set Role to LAN.
      • For the interface connected to local endpoint clients, set the IP/Network Mask to 10.1.100.3/255.255.255.0.
2. Configure the static route to connect to the Internet:
   1. Go to Network > Static Routes and click Create New or Create New > IPv4 Static Route.
      • Set Destination to 0.0.0.0/0.0.0.0.
      • Set Interface to wan1.
      • Set Gateway Address to 192.168.7.2.
   2. Click OK.
3. Configure IPsec VPN:
   1. Go to VPN > IPsec Wizard.
      • Set VPN Name to To-HQ1.
      • Set Template Type to Custom.
      • Click Next.
      • In the Network IP Address, enter 10.2.200.1.
      • Set Interface to wan1.
      • Set Authentication to Method.
      • Set Pre-shared Key to 123456.
   2. Leave all other fields in their default values and click OK.
4. Configure the IPsec VPN interface IP address which will be used to form Security Fabric:
   1. Go to Network > Interfaces.
   2. Edit To-HQ1:
      • Set Role to WAN.
      • Set the IP/Network Mask to 10.10.10.3/255.255.255.255.
      • Set Remote IP/Network Mask to 10.10.10.1/255.255.255.0.0.
5. Configure IPsec VPN local and remote subnet:
   1. Go to Policy & Objects > Addresses.
   2. Click Create New
      • Set Name to To-HQ1_local_subnet_1.
      • Set Type to Subnet.
      • Set IP/Network Mask to 10.1.100.0/24.
   3. Click OK.
   4. Click Create New
      • Set Name to To-HQ1_remote_subnet_1.
      • Set Type to Subnet.
      • Set IP/Network Mask to 192.168.8.0/24.
   5. Click OK.
6. Configure IPsec VPN static routes:
   1. Go to Network > Static Routes and click Create New or Create New > IPv4 Static Route.
      • For Named Address, select Type and select To-HQ1_remote_subnet_1.
      • Set Interface to To-HQ1.
   2. Click OK.
   3. Click Create New or Create New > IPv4 Static Route.
      • For Named Address, select Type and select To-HQ1_remote_subnet_1.
      • Set Interface to Blackhole.
      • Set Administrative Distance to 254.
   4. Click OK.
7. Configure IPsec VPN policies:
   1. Go to Policy & Objects > IPv4 Policy and click Create New.
      • Set Name to vpn_To-HQ1_local.
      • Set Incoming Interface to vlan20.
      • Set Outgoing Interface to To-HQ1.
      • Set Source to To-HQ1_local_subnet_1.
      • Set Destination to To-HQ1_remote_subnet_1.
      • Set Schedule to Always.
      • Set Service to All.
      • Disable NAT.
   2. Click OK.
   3. Click Create New.
      • Set Name to vpn_To-HQ1_remote.
      • Set Incoming Interface to To-HQ1.
      • Set Outgoing Interface to vlan20.
      • Set Source to To-HQ1_remote_subnet_1.
      • Set Destination to -HQ1_local_subnet_1.
      • Set Schedule to Always.
      • Set Service to All.
      • Disable NAT.
   4. Click OK.
8. Configure Security Fabric:
   1. Go to Security Fabric > Settings.
   2. Enable FortiGate Telemetry.

      After FortiGate Telemetry is enabled, FortiAnalyzer automatically enables Logging. FortiAnalyzer settings will be retrieved when the downstream FortiGate connects to the root FortiGate.

   3. Set Security Fabric role to Join Existing Fabric.
   4. Set Upstream FortiGate IP to 10.10.10.1.
   5. Click Apply.

To authorize the downstream FortiGate (HQ2) on the root FortiGate (HQ1):

1. In the root FortiGate (HQ1), go to Security Fabric > Settings.

   The Topology field highlights the connected FortiGate (HQ2) with the serial number and asks you to authorize the highlighted device.

2. Select the highlighted FortiGate and select Authorize.

   After authorization, the downstream FortiGate (HQ2) appears in the Topology field in Security Fabric > Settings. This means the downstream FortiGate (HQ2) has successfully joined the Security Fabric.

To check Security Fabric over IPsec VPN:

1. On the root FortiGate (HQ1), go to Security Fabric > Physical Topology.

   The root FortiGate (HQ1) is connected by the downstream FortiGate (HQ2) with VPN icon in the middle.

   

2. On the root FortiGate (HQ1), go to Security Fabric > Logical Topology.

   The root FortiGate (HQ1) VPN interface To-HQ2 is connected by downstream FortiGate (HQ2) VPN interface To-HQ1 with VPN icon in the middle.

   

To run diagnose commands:

1. Run the diagnose sys csf authorization pending-list command in the root FortiGate (HQ1) to show the downstream FortiGate pending for root FortiGate authorization:

   HQ1 # diagnose sys csf authorization pending-list
   Serial                  IP Address      HA-Members                                      Path
   ------------------------------------------------------------------------------------
   FG101ETK18002187        0.0.0.0                                                         FG3H1E5818900718:FG101ETK18002187

2. Run the diagnose sys csf downstream command in the root FortiGate (HQ1) to show the downstream FortiGate (HQ2) after it joins Security Fabric:

   HQ1 # diagnose sys csf downstream
    1:     FG101ETK18002187 (10.10.10.3) Management-IP: 0.0.0.0 Management-port:0 parent: FG3H1E5818900718
           path:FG3H1E5818900718:FG101ETK18002187
           data received: Y downstream intf:To-HQ1 upstream intf:To-HQ2 admin-port:443
           authorizer:FG3H1E5818900718

3. Run the diagnose sys csf upstream command in the downstream FortiGate (HQ2) to show the root FortiGate (HQ1) after the downstream FortiGate joins Security Fabric:

   HQ2 # diagnose sys csf upstream
   Upstream Information:
   Serial Number:FG3H1E5818900718
   IP:10.10.10.1
   Connecting interface:To-HQ1
   Connection status:Authorized