Fortinet black logo

Administration Guide

IPsec aggregate for redundancy and traffic load-balancing

IPsec aggregate for redundancy and traffic load-balancing

This is a sample configuration of a multiple site-to-site IPsec VPN that uses an IPsec aggregate interface to set up redundancy and traffic load-balancing. The VPN tunnel interfaces must have net-device disabled in order to be members of the IPsec aggregate.

Each FortiGate has two WAN interfaces connected to different ISPs. OSPF runs over the IPsec aggregate in this configuration.

The supported load balancing algorithms are: L3, L4, round-robin (default), weighted round-robin, and redundant. The first four options allow traffic to be load-balanced, while the last option (redundant) uses the first tunnel that is up for all traffic.

Dynamic routing can run on the aggregate interface, and it can be a member interface in SD-WAN (not shown in this configuration).

Configuring the HQ1 FortiGate in the GUI

There are five steps to configure the FortiGate:

  1. Create the IPsec tunnels.
  2. Create the IPsec aggregate.
  3. Configure the firewall policies.
  4. Configure the aggregate VPN interface IPs.
  5. Configure OSPF.
To create the IPsec tunnels:
  1. Go to VPN > IPsec Wizard and select the Custom template.
  2. For Name, enter pri_HQ2 and click Next.
  3. Enter the following:

    Phase 1

    IP Address

    172.16.202.1

    Interface

    port1

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

  4. Configure the other settings as needed.
  5. Click OK.
  6. Create another tunnel named sec_HQ2 with the following settings:

    Phase 1

    IP Address

    172.17.202.1

    Interface

    port2

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

To create the IPsec aggregate:
  1. Go to VPN > IPsec Tunnels and click Create New > IPsec Aggregate.
  2. For Name, enter agg_HQ2.
  3. Select a load balancing algorithm.
  4. From the Tunnel dropdown, select the tunnels that you created previously (pri_HQ2 and sec_HQ2). If required, enter weights for each tunnel.
  5. Click OK.
To configure the firewall policies:
  1. Go to Policy & Objects > Firewall Policy.
  2. Create an inbound traffic policy with the following settings:

    Name

    inbound

    Incoming Interface

    agg_HQ2

    Outgoing Interface

    dmz

    Source

    172.16.101.0

    Destination

    10.1.100.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

  3. Click OK.
  4. Create an outbound traffic policy with the following settings:

    Name

    outbound

    Incoming Interface

    dmz

    Outgoing Interface

    agg_HQ2

    Source

    10.1.100.0

    Destination

    172.16.101.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

To configure the aggregate VPN interface IPs:
  1. Go to Network > Interfaces and edit agg_HQ2.
  2. For IP, enter 10.10.10.1.
  3. For Remote IP/Netmask, enter 10.10.10.2 255.255.255.255.
  4. Click OK.
To configure OSPF:
  1. Go to Network > OSPF.
  2. For Router ID, enter 1.1.1.1.
  3. In the Areas table, click Create New.
    1. For Area ID, enter 0.0.0.0.
    2. Click OK.
  4. In the Networks table, click Create New.
    1. Set the Area to 0.0.0.0.
    2. For IP/Netmask, enter 10.1.100.0/24.
    3. Click OK.
    4. Click Create New.
    5. For IP/Netmask, enter 10.10.10.0/24.
    6. Click OK.
  5. Click Apply.

Configuring the HQ2 FortiGate in the GUI

There are five steps to configure the FortiGate:

  1. Create the IPsec tunnels.
  2. Create the IPsec aggregate.
  3. Configure the firewall policies.
  4. Configure the aggregate VPN interface IPs.
  5. Configure OSPF.
To create the IPsec tunnels:
  1. Go to VPN > IPsec Wizard and select the Custom template.
  2. For Name, enter pri_HQ1 and click Next.
  3. Enter the following:

    Phase 1

    IP Address

    172.16.200.1

    Interface

    port25

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

  4. Configure the other settings as needed.
  5. Click OK.
  6. Create another tunnel named sec_HQ1 with the following settings:

    Phase 1

    IP Address

    172.17.200.1

    Interface

    port26

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

To create the IPsec aggregate:
  1. Go to VPN > IPsec Tunnels and click Create New > IPsec Aggregate.
  2. For Name, enter agg_HQ1.
  3. Select a load balancing algorithm.
  4. From the Tunnel dropdown, select the tunnels that you created previously (pri_HQ1 and sec_HQ1). If required, enter weights for each tunnel.
  5. Click OK.
To configure the firewall policies:
  1. Go to Policy & Objects > Firewall Policy.
  2. Create an inbound traffic policy with the following settings:

    Name

    inbound

    Incoming Interface

    agg_HQ1

    Outgoing Interface

    port9

    Source

    10.1.100.0

    Destination

    172.16.101.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

  3. Click OK.
  4. Create an outbound traffic policy with the following settings:

    Name

    outbound

    Incoming Interface

    port9

    Outgoing Interface

    agg_HQ1

    Source

    172.16.101.0

    Destination

    10.1.100.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

To configure the aggregate VPN interface IPs:
  1. Go to Network > Interfaces and edit agg_HQ1.
  2. For IP, enter 10.10.10.2.
  3. For Remote IP/Netmask, enter 10.10.10.1 255.255.255.255.
  4. Click OK.
To configure OSPF:
  1. Go to Network > OSPF.
  2. For Router ID, enter 2.2.2.2.
  3. In the Areas table, click Create New.
    1. For Area ID, enter 0.0.0.0.
    2. Click OK.
  4. In the Networks table, click Create New.
    1. Set the Area to 0.0.0.0.
    2. For IP/Netmask, enter 172.16.101.0/24.
    3. Click OK.
    4. Click Create New.
    5. For IP/Netmask, enter 10.10.10.0/24.
    6. Click OK.
  5. Click Apply.

Monitoring the traffic in the GUI

To monitor the traffic:
  1. Go to Dashboard > Network , hover over the IPsec widget, then click Expand to Full Screen.
  2. Expand the aggregate tunnel in the table to view statistics for each aggregate member.

Configuring the HQ1 FortiGate in the CLI

There are six steps to configure the FortiGate:

  1. Configure the interfaces.
  2. Configure two IPsec phase 1 and phase 2 interfaces.
  3. Configure the IPsec aggregate.
  4. Configure the firewall policies.
  5. Configure the aggregate VPN interface IPs.
  6. Configure OSPF.
To configure the interfaces:
  1. Configure port1, port2, and dmz as shown in the topology diagram.
To configure two IPsec phase 1 and phase 2 interfaces:

config vpn ipsec phase1-interface

edit "pri_HQ2"

set interface "port1"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.16.202.1

set psksecret sample1

next

edit "sec_HQ2"

set interface "port2"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.17.202.1

set psksecret sample2

next

end

config vpn ipsec phase2-interface

edit "pri_HQ2"

set phase1name "pri_HQ2"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

edit "sec_HQ2"

set phase1name "sec_HQ2"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

end

To configure the IPsec aggregate:

config system ipsec-aggregate

edit "agg_HQ2"

set member "pri_HQ2" "sec_HQ2"

next

end

To configure the firewall policies:

config firewall policy

edit 1

set name "inbound"

set srcintf "agg_HQ2"

set dstintf "dmz"

set srcaddr "172.16.101.0"

set dstaddr "10.1.100.0"

set action accept

set schedule "always"

set service "ALL"

next

edit 2

set name "outbound"

set srcintf "dmz"

set dstintf "agg_HQ2"

set srcaddr "10.1.100.0"

set dstaddr "172.16.101.0"

set action accept

set schedule "always"

set service "ALL"

next

end

To configure the aggregate VPN interface IPs:

config system interface

edit "agg_HQ2"

set ip 10.10.10.1 255.255.255.255

set remote-ip 10.10.10.2 255.255.255.255

next

end

To configure OSPF:

config router ospf

set router-id 1.1.1.1

config area

edit 0.0.0.0

next

end

config network

edit 1

set prefix 10.1.100.0 255.255.255.0

next

edit 2

set prefix 10.10.10.0 255.255.255.0

next

end

end

Configuring the HQ2 FortiGate in the CLI

There are six steps to configure the FortiGate:

  1. Configure the interfaces.
  2. Configure two IPsec phase 1 and phase 2 interfaces.
  3. Configure the IPsec aggregate.
  4. Configure the firewall policies.
  5. Configure the aggregate VPN interface IPs.
  6. Configure OSPF.
To configure the interfaces:
  1. Configure port25, port26, and port9 as shown in the topology diagram.
To configure two IPsec phase 1 and phase 2 interfaces:

config vpn ipsec phase1-interface

edit "pri_HQ1"

set interface "port25"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.16.200.1

set psksecret sample1

next

edit "sec_HQ1"

set interface "port26"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.17.200.1

set psksecret sample2

next

end

config vpn ipsec phase2-interface

edit "pri_HQ1"

set phase1name "pri_HQ1"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

edit "sec_HQ1"

set phase1name "sec_HQ1"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

end

To configure the IPsec aggregate:

config system ipsec-aggregate

edit "agg_HQ1"

set member "pri_HQ1" "sec_HQ1"

next

end

To configure the firewall policies:

config firewall policy

edit 1

set name "inbound"

set srcintf "agg_HQ1"

set dstintf "port9"

set srcaddr "10.1.100.0"

set dstaddr "172.16.101.0"

set action accept

set schedule "always"

set service "ALL"

next

edit 2

set name "outbound"

set srcintf "port9"

set dstintf "agg_HQ1"

set srcaddr "172.16.101.0"

set dstaddr "10.1.100.0"

set action accept

set schedule "always"

set service "ALL"

next

end

To configure the aggregate VPN interface IPs:

config system interface

edit "agg_HQ1"

set ip 10.10.10.2 255.255.255.255

set remote-ip 10.10.10.1 255.255.255.255

next

end

To configure OSPF:

config router ospf

set router-id 2.2.2.2

config area

edit 0.0.0.0

next

end

config network

edit 1

set prefix 172.16.101.0 255.255.255.0

next

edit 2

set prefix 10.10.10.0 255.255.255.0

next

end

end

Monitoring the traffic in the CLI

To view debugging information:
  1. Verify the status of the phase 1 IKE SAs:

    # diagnose vpn ike gateway list

    vd: root/0

    name: pri_HQ2

    version: 1

    interface: port1 11

    addr: 172.16.200.1:500 -> 172.16.202.1:500

    created: 1520s ago

    IKE SA: created 1/2 established 1/1 time 10/10/10 ms

    IPsec SA: created 2/2 established 1/1 time 0/0/0 ms

    id/spi: 173 dcdede154681579b/e32f4c48c4349fc0 direction: responder status: established 1498-1498s ago = 10ms proposal: aes128-sha256 key: d7230a68d7b83def-588b94495cfa9d38 lifetime/rekey: 86400/84631 DPD sent/recv: 0000000d/00000006

    vd: root/0

    name: sec_HQ2

    version: 1

    interface: port2 12

    addr: 172.17.200.1:500 -> 172.17.202.1:500

    created: 1520s ago

    IKE SA: created 1/2 established 1/1 time 10/10/10 ms

    IPsec SA: created 2/2 established 1/1 time 0/0/0 ms

    id/spi: 174 a567bd7bf02a04b5/4251b6254660aee2 direction: responder status: established 1498-1498s ago = 10ms proposal: aes128-sha256 key: 9f44f500c28d8de6-febaae9d1e6a164c lifetime/rekey: 86400/84631 DPD sent/recv: 00000008/0000000c

  2. Verify the phase 2 IPsec tunnel SAs:

    # diagnose vpn tunnel list

    list all ipsec tunnel in vd 0

    name=sec_HQ2 ver=1 serial=2 172.17.200.1:0->172.17.202.1:0

    bound_if=5 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/512 options[0200]=frag-rfc run_state=1 accept_traffic=1

    proxyid_num=1 child_num=0 refcnt=7 ilast=5 olast=5 ad=/0

    stat: rxp=39 txp=40 rxb=5448 txb=2732

    dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=15

    natt: mode=none draft=0 interval=0 remote_port=0

    proxyid=sec_HQ2 proto=0 sa=1 ref=2 serial=2 auto-negotiate

    src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=41230/0B replaywin=2048

    seqno=29 esn=0 replaywin_lastseq=00000028 itn=0

    life: type=01 bytes=0/0 timeout=42899/43200 dec: spi=1071b4f9 esp=aes key=16 1f4dbb78bea8e97650b52d8170b5ece7

    ah=sha1 key=20 cd9bf2de0f49296cf489dd915d7baf6d78bc8f12

    enc: spi=ec89b7ee esp=aes key=16 0546efecd0d1b9ba5944f635896e4404

    ah=sha1 key=20 34599bc7dc25e1ce63ac9615bd50928ce0667dc8

    dec:pkts/bytes=39/2796, enc:pkts/bytes=40/5456

    name=pri_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0

    bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/512 options[0200]=frag-rfc run_state=1 accept_traffic=1

    proxyid_num=1 child_num=0 refcnt=5 ilast=15 olast=15 ad=/0

    stat: rxp=38 txp=39 rxb=5152 txb=2768

    dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=20

    natt: mode=none draft=0 interval=0 remote_port=0

    proxyid=pri_HQ2 proto=0 sa=1 ref=2 serial=2 auto-negotiate

    src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=41231/0B replaywin=2048

    seqno=28 esn=0 replaywin_lastseq=00000027 itn=0

    life: type=01 bytes=0/0 timeout=42900/43200 dec: spi=1071b4f8 esp=aes key=16 142cce377b3432ba41e64128ade6848c

    ah=sha1 key=20 20e64947e2397123f561584321adc0e7aa0c342d

    enc: spi=ec89b7ed esp=aes key=16 2ec13622fd60dacce3d28ebe5fe7ab14

    ah=sha1 key=20 c1787497508a87f40c73c0db0e835c70b3c3f42d

    dec:pkts/bytes=38/2568, enc:pkts/bytes=39/5432

  3. Debug the IPsec aggregation list:

    # diagnose sys ipsec-aggregate list

    agg_HQ2 algo=RR member=2 run_tally=2

    members:

    pri_HQ2

    sec_HQ2

  4. Verify the OSPF neighbor information:

    # get router info ospf neighbor

    OSPF process 0, VRF 0:

    Neighbor ID Pri State Dead Time Address Interface

    2.2.2.2 1. Full/ - 00:00:34 10.10.10.2 agg1_HQ2

  5. Verify the OSPF routing table:

    # get router info routing-table ospf

    Routing table for VRF=0

    O 172.16.101.0/24 [110/20] via 10.10.10.2, agg1_HQ2 , 00:18:43

IPsec aggregate for redundancy and traffic load-balancing

This is a sample configuration of a multiple site-to-site IPsec VPN that uses an IPsec aggregate interface to set up redundancy and traffic load-balancing. The VPN tunnel interfaces must have net-device disabled in order to be members of the IPsec aggregate.

Each FortiGate has two WAN interfaces connected to different ISPs. OSPF runs over the IPsec aggregate in this configuration.

The supported load balancing algorithms are: L3, L4, round-robin (default), weighted round-robin, and redundant. The first four options allow traffic to be load-balanced, while the last option (redundant) uses the first tunnel that is up for all traffic.

Dynamic routing can run on the aggregate interface, and it can be a member interface in SD-WAN (not shown in this configuration).

Configuring the HQ1 FortiGate in the GUI

There are five steps to configure the FortiGate:

  1. Create the IPsec tunnels.
  2. Create the IPsec aggregate.
  3. Configure the firewall policies.
  4. Configure the aggregate VPN interface IPs.
  5. Configure OSPF.
To create the IPsec tunnels:
  1. Go to VPN > IPsec Wizard and select the Custom template.
  2. For Name, enter pri_HQ2 and click Next.
  3. Enter the following:

    Phase 1

    IP Address

    172.16.202.1

    Interface

    port1

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

  4. Configure the other settings as needed.
  5. Click OK.
  6. Create another tunnel named sec_HQ2 with the following settings:

    Phase 1

    IP Address

    172.17.202.1

    Interface

    port2

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

To create the IPsec aggregate:
  1. Go to VPN > IPsec Tunnels and click Create New > IPsec Aggregate.
  2. For Name, enter agg_HQ2.
  3. Select a load balancing algorithm.
  4. From the Tunnel dropdown, select the tunnels that you created previously (pri_HQ2 and sec_HQ2). If required, enter weights for each tunnel.
  5. Click OK.
To configure the firewall policies:
  1. Go to Policy & Objects > Firewall Policy.
  2. Create an inbound traffic policy with the following settings:

    Name

    inbound

    Incoming Interface

    agg_HQ2

    Outgoing Interface

    dmz

    Source

    172.16.101.0

    Destination

    10.1.100.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

  3. Click OK.
  4. Create an outbound traffic policy with the following settings:

    Name

    outbound

    Incoming Interface

    dmz

    Outgoing Interface

    agg_HQ2

    Source

    10.1.100.0

    Destination

    172.16.101.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

To configure the aggregate VPN interface IPs:
  1. Go to Network > Interfaces and edit agg_HQ2.
  2. For IP, enter 10.10.10.1.
  3. For Remote IP/Netmask, enter 10.10.10.2 255.255.255.255.
  4. Click OK.
To configure OSPF:
  1. Go to Network > OSPF.
  2. For Router ID, enter 1.1.1.1.
  3. In the Areas table, click Create New.
    1. For Area ID, enter 0.0.0.0.
    2. Click OK.
  4. In the Networks table, click Create New.
    1. Set the Area to 0.0.0.0.
    2. For IP/Netmask, enter 10.1.100.0/24.
    3. Click OK.
    4. Click Create New.
    5. For IP/Netmask, enter 10.10.10.0/24.
    6. Click OK.
  5. Click Apply.

Configuring the HQ2 FortiGate in the GUI

There are five steps to configure the FortiGate:

  1. Create the IPsec tunnels.
  2. Create the IPsec aggregate.
  3. Configure the firewall policies.
  4. Configure the aggregate VPN interface IPs.
  5. Configure OSPF.
To create the IPsec tunnels:
  1. Go to VPN > IPsec Wizard and select the Custom template.
  2. For Name, enter pri_HQ1 and click Next.
  3. Enter the following:

    Phase 1

    IP Address

    172.16.200.1

    Interface

    port25

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

  4. Configure the other settings as needed.
  5. Click OK.
  6. Create another tunnel named sec_HQ1 with the following settings:

    Phase 1

    IP Address

    172.17.200.1

    Interface

    port26

    Device creation

    Disabled

    Aggregate member

    Enabled

    Authentication Method

    Pre-shared Key

    Pre-shared Key

    Enter the secure key

    IKE Mode

    Aggressive

    Peer Options Accept Types

    Any peer ID

    Phase 2

    Auto-negotiate

    Enable

To create the IPsec aggregate:
  1. Go to VPN > IPsec Tunnels and click Create New > IPsec Aggregate.
  2. For Name, enter agg_HQ1.
  3. Select a load balancing algorithm.
  4. From the Tunnel dropdown, select the tunnels that you created previously (pri_HQ1 and sec_HQ1). If required, enter weights for each tunnel.
  5. Click OK.
To configure the firewall policies:
  1. Go to Policy & Objects > Firewall Policy.
  2. Create an inbound traffic policy with the following settings:

    Name

    inbound

    Incoming Interface

    agg_HQ1

    Outgoing Interface

    port9

    Source

    10.1.100.0

    Destination

    172.16.101.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

  3. Click OK.
  4. Create an outbound traffic policy with the following settings:

    Name

    outbound

    Incoming Interface

    port9

    Outgoing Interface

    agg_HQ1

    Source

    172.16.101.0

    Destination

    10.1.100.0

    Schedule

    always

    Action

    ACCEPT

    Service

    ALL

To configure the aggregate VPN interface IPs:
  1. Go to Network > Interfaces and edit agg_HQ1.
  2. For IP, enter 10.10.10.2.
  3. For Remote IP/Netmask, enter 10.10.10.1 255.255.255.255.
  4. Click OK.
To configure OSPF:
  1. Go to Network > OSPF.
  2. For Router ID, enter 2.2.2.2.
  3. In the Areas table, click Create New.
    1. For Area ID, enter 0.0.0.0.
    2. Click OK.
  4. In the Networks table, click Create New.
    1. Set the Area to 0.0.0.0.
    2. For IP/Netmask, enter 172.16.101.0/24.
    3. Click OK.
    4. Click Create New.
    5. For IP/Netmask, enter 10.10.10.0/24.
    6. Click OK.
  5. Click Apply.

Monitoring the traffic in the GUI

To monitor the traffic:
  1. Go to Dashboard > Network , hover over the IPsec widget, then click Expand to Full Screen.
  2. Expand the aggregate tunnel in the table to view statistics for each aggregate member.

Configuring the HQ1 FortiGate in the CLI

There are six steps to configure the FortiGate:

  1. Configure the interfaces.
  2. Configure two IPsec phase 1 and phase 2 interfaces.
  3. Configure the IPsec aggregate.
  4. Configure the firewall policies.
  5. Configure the aggregate VPN interface IPs.
  6. Configure OSPF.
To configure the interfaces:
  1. Configure port1, port2, and dmz as shown in the topology diagram.
To configure two IPsec phase 1 and phase 2 interfaces:

config vpn ipsec phase1-interface

edit "pri_HQ2"

set interface "port1"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.16.202.1

set psksecret sample1

next

edit "sec_HQ2"

set interface "port2"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.17.202.1

set psksecret sample2

next

end

config vpn ipsec phase2-interface

edit "pri_HQ2"

set phase1name "pri_HQ2"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

edit "sec_HQ2"

set phase1name "sec_HQ2"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

end

To configure the IPsec aggregate:

config system ipsec-aggregate

edit "agg_HQ2"

set member "pri_HQ2" "sec_HQ2"

next

end

To configure the firewall policies:

config firewall policy

edit 1

set name "inbound"

set srcintf "agg_HQ2"

set dstintf "dmz"

set srcaddr "172.16.101.0"

set dstaddr "10.1.100.0"

set action accept

set schedule "always"

set service "ALL"

next

edit 2

set name "outbound"

set srcintf "dmz"

set dstintf "agg_HQ2"

set srcaddr "10.1.100.0"

set dstaddr "172.16.101.0"

set action accept

set schedule "always"

set service "ALL"

next

end

To configure the aggregate VPN interface IPs:

config system interface

edit "agg_HQ2"

set ip 10.10.10.1 255.255.255.255

set remote-ip 10.10.10.2 255.255.255.255

next

end

To configure OSPF:

config router ospf

set router-id 1.1.1.1

config area

edit 0.0.0.0

next

end

config network

edit 1

set prefix 10.1.100.0 255.255.255.0

next

edit 2

set prefix 10.10.10.0 255.255.255.0

next

end

end

Configuring the HQ2 FortiGate in the CLI

There are six steps to configure the FortiGate:

  1. Configure the interfaces.
  2. Configure two IPsec phase 1 and phase 2 interfaces.
  3. Configure the IPsec aggregate.
  4. Configure the firewall policies.
  5. Configure the aggregate VPN interface IPs.
  6. Configure OSPF.
To configure the interfaces:
  1. Configure port25, port26, and port9 as shown in the topology diagram.
To configure two IPsec phase 1 and phase 2 interfaces:

config vpn ipsec phase1-interface

edit "pri_HQ1"

set interface "port25"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.16.200.1

set psksecret sample1

next

edit "sec_HQ1"

set interface "port26"

set peertype any

set net-device disable

set aggregate-member enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1

set remote-gw 172.17.200.1

set psksecret sample2

next

end

config vpn ipsec phase2-interface

edit "pri_HQ1"

set phase1name "pri_HQ1"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

edit "sec_HQ1"

set phase1name "sec_HQ1"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

next

end

To configure the IPsec aggregate:

config system ipsec-aggregate

edit "agg_HQ1"

set member "pri_HQ1" "sec_HQ1"

next

end

To configure the firewall policies:

config firewall policy

edit 1

set name "inbound"

set srcintf "agg_HQ1"

set dstintf "port9"

set srcaddr "10.1.100.0"

set dstaddr "172.16.101.0"

set action accept

set schedule "always"

set service "ALL"

next

edit 2

set name "outbound"

set srcintf "port9"

set dstintf "agg_HQ1"

set srcaddr "172.16.101.0"

set dstaddr "10.1.100.0"

set action accept

set schedule "always"

set service "ALL"

next

end

To configure the aggregate VPN interface IPs:

config system interface

edit "agg_HQ1"

set ip 10.10.10.2 255.255.255.255

set remote-ip 10.10.10.1 255.255.255.255

next

end

To configure OSPF:

config router ospf

set router-id 2.2.2.2

config area

edit 0.0.0.0

next

end

config network

edit 1

set prefix 172.16.101.0 255.255.255.0

next

edit 2

set prefix 10.10.10.0 255.255.255.0

next

end

end

Monitoring the traffic in the CLI

To view debugging information:
  1. Verify the status of the phase 1 IKE SAs:

    # diagnose vpn ike gateway list

    vd: root/0

    name: pri_HQ2

    version: 1

    interface: port1 11

    addr: 172.16.200.1:500 -> 172.16.202.1:500

    created: 1520s ago

    IKE SA: created 1/2 established 1/1 time 10/10/10 ms

    IPsec SA: created 2/2 established 1/1 time 0/0/0 ms

    id/spi: 173 dcdede154681579b/e32f4c48c4349fc0 direction: responder status: established 1498-1498s ago = 10ms proposal: aes128-sha256 key: d7230a68d7b83def-588b94495cfa9d38 lifetime/rekey: 86400/84631 DPD sent/recv: 0000000d/00000006

    vd: root/0

    name: sec_HQ2

    version: 1

    interface: port2 12

    addr: 172.17.200.1:500 -> 172.17.202.1:500

    created: 1520s ago

    IKE SA: created 1/2 established 1/1 time 10/10/10 ms

    IPsec SA: created 2/2 established 1/1 time 0/0/0 ms

    id/spi: 174 a567bd7bf02a04b5/4251b6254660aee2 direction: responder status: established 1498-1498s ago = 10ms proposal: aes128-sha256 key: 9f44f500c28d8de6-febaae9d1e6a164c lifetime/rekey: 86400/84631 DPD sent/recv: 00000008/0000000c

  2. Verify the phase 2 IPsec tunnel SAs:

    # diagnose vpn tunnel list

    list all ipsec tunnel in vd 0

    name=sec_HQ2 ver=1 serial=2 172.17.200.1:0->172.17.202.1:0

    bound_if=5 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/512 options[0200]=frag-rfc run_state=1 accept_traffic=1

    proxyid_num=1 child_num=0 refcnt=7 ilast=5 olast=5 ad=/0

    stat: rxp=39 txp=40 rxb=5448 txb=2732

    dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=15

    natt: mode=none draft=0 interval=0 remote_port=0

    proxyid=sec_HQ2 proto=0 sa=1 ref=2 serial=2 auto-negotiate

    src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=41230/0B replaywin=2048

    seqno=29 esn=0 replaywin_lastseq=00000028 itn=0

    life: type=01 bytes=0/0 timeout=42899/43200 dec: spi=1071b4f9 esp=aes key=16 1f4dbb78bea8e97650b52d8170b5ece7

    ah=sha1 key=20 cd9bf2de0f49296cf489dd915d7baf6d78bc8f12

    enc: spi=ec89b7ee esp=aes key=16 0546efecd0d1b9ba5944f635896e4404

    ah=sha1 key=20 34599bc7dc25e1ce63ac9615bd50928ce0667dc8

    dec:pkts/bytes=39/2796, enc:pkts/bytes=40/5456

    name=pri_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0

    bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/512 options[0200]=frag-rfc run_state=1 accept_traffic=1

    proxyid_num=1 child_num=0 refcnt=5 ilast=15 olast=15 ad=/0

    stat: rxp=38 txp=39 rxb=5152 txb=2768

    dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=20

    natt: mode=none draft=0 interval=0 remote_port=0

    proxyid=pri_HQ2 proto=0 sa=1 ref=2 serial=2 auto-negotiate

    src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=41231/0B replaywin=2048

    seqno=28 esn=0 replaywin_lastseq=00000027 itn=0

    life: type=01 bytes=0/0 timeout=42900/43200 dec: spi=1071b4f8 esp=aes key=16 142cce377b3432ba41e64128ade6848c

    ah=sha1 key=20 20e64947e2397123f561584321adc0e7aa0c342d

    enc: spi=ec89b7ed esp=aes key=16 2ec13622fd60dacce3d28ebe5fe7ab14

    ah=sha1 key=20 c1787497508a87f40c73c0db0e835c70b3c3f42d

    dec:pkts/bytes=38/2568, enc:pkts/bytes=39/5432

  3. Debug the IPsec aggregation list:

    # diagnose sys ipsec-aggregate list

    agg_HQ2 algo=RR member=2 run_tally=2

    members:

    pri_HQ2

    sec_HQ2

  4. Verify the OSPF neighbor information:

    # get router info ospf neighbor

    OSPF process 0, VRF 0:

    Neighbor ID Pri State Dead Time Address Interface

    2.2.2.2 1. Full/ - 00:00:34 10.10.10.2 agg1_HQ2

  5. Verify the OSPF routing table:

    # get router info routing-table ospf

    Routing table for VRF=0

    O 172.16.101.0/24 [110/20] via 10.10.10.2, agg1_HQ2 , 00:18:43