VXLAN over IPsec tunnel with virtual wire pair

In this example, a site-to-site VPN tunnel is formed between two FortiGates. Multiple VLANs are configured that match on each FortiGate. Host1 and Host2 are connected to VLAN10 on the switches.

To configure FGT-A in the CLI:

1. Configure the WAN interface:

   config system interface
       edit "wan1"
           set vdom "root"
           set ip 11.11.11.11 255.255.255.0
           set allowaccess ping https ssh http fgfm
           set type physical
           set role wan
           set snmp-index 1
       next
   end

2. Configure a static route to send all traffic out the WAN interface:

   config router static  
       edit 1
           set gateway 11.11.11.1
           set device "wan1"
       next
   end

3. Configure the IPsec tunnel:

   config vpn ipsec phase1-interface
       edit "ipsec"
           set interface "wan1"
           set peertype any
           set proposal aes256-sha1
           set remote-gw 22.22.22.22
           set psksecret **********
       next
   end
   config vpn ipsec phase2-interface
       edit "ipsec"
           set phase1name "ipsec"
           set proposal aes256-sha1
           set auto-negotiate enable
       next
   end

4. Configure the VXLAN interface and bind it to the IPsec interface:

   config system vxlan
       edit "vxlan"
           set interface "ipsec"
           set vni 10
           set remote-ip "22.22.22.22"
       next
   end

   The remote IP address is the peer side WAN IP address.

5. Configure a virtual wire pair with the LAN and VXLAN interfaces as members:

   config system virtual-wire-pair
       edit "vwp"
           set member "port1" "vxlan"
           set wildcard-vlan enable
       next
   end

   The interfaces added to the virtual wire pair cannot be part of a switch, such as the default internal interface.

   By enabling wildcard VLANs on the virtual wire pair, all VLAN tagged traffic that is allowed by the virtual wire pair firewall policies passes through the pair.

6. Configure a firewall policy to allow traffic between the LAN and VXLAN interfaces:

   config firewall policy
       edit 4
           set name "vwp-pol"
           set srcintf "port1" "vxlan"
           set dstintf "port1" "vxlan"
           set srcaddr "all"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
       next
   end

To configure FGT-B in the CLI:

1. Configure the WAN interface:

   config system interface
       edit "wan1"
           set vdom "root"
           set ip 22.22.22.22 255.255.255.0 255.255.255.0
           set allowaccess ping https ssh http fgfm
           set type physical
           set role wan
           set snmp-index 1
       next
   end

2. Configure a static route to send all traffic out the WAN interface:

   config router static  
       edit 1
           set gateway 22.22.22.2
           set device "wan1"
       next
   end

3. Configure the IPsec tunnel:

   config vpn ipsec phase1-interface
       edit "ipsec"
           set interface "wan1"
           set peertype any
           set proposal aes256-sha1
           set remote-gw 11.11.11.11
           set psksecret **********
       next
   end
   config vpn ipsec phase2-interface
       edit "ipsec"
           set phase1name "ipsec"
           set proposal aes256-sha1
           set auto-negotiate enable
       next
   end

4. Configure the VXLAN interface and bind it to the IPsec interface:

   config system vxlan
       edit "vxlan"
           set interface "ipsec"
           set vni 10
           set remote-ip "11.11.11.11"
       next
   end

   The remote IP address is the peer side WAN IP address.

5. Configure a virtual wire pair with the LAN and VXLAN interfaces as members:

   config system virtual-wire-pair
       edit "vwp"
           set member "port1" "vxlan"
           set wildcard-vlan enable
       next
   end

6. Configure a firewall policy to allow traffic between the LAN and VXLAN interfaces:

   config firewall policy
       edit 4
           set name "vwp-pol"
           set srcintf "port1" "vxlan"
           set dstintf "port1" "vxlan"
           set srcaddr "all"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
       next
   end

Test the configuration

To test the configuration, ping Host2 (VLAN10: 192.168.10.2/24) from Host1 (VLAN10: 192.168.10.1/24):

C:\>ping 192.168.10.2

Pinging 192.168.10.2 with 32 bytes of data:
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=11ms TTL=56

Ping statistics for 192.168.10.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 8ms, Maximum = 11ms, Average = 8ms