Fortinet black logo

Administration Guide

VXLAN over IPsec tunnel with virtual wire pair

VXLAN over IPsec tunnel with virtual wire pair

In this example, a site-to-site VPN tunnel is formed between two FortiGates. Multiple VLANs are configured that match on each FortiGate. Host1 and Host2 are connected to VLAN10 on the switches.

To configure FGT-A in the CLI:
  1. Configure the WAN interface:

    config system interface
        edit "wan1"
            set vdom "root"
            set ip 11.11.11.11 255.255.255.0
            set allowaccess ping https ssh http fgfm
            set type physical
            set role wan
            set snmp-index 1
        next
    end
  2. Configure a static route to send all traffic out the WAN interface:

    config router static  
        edit 1
            set gateway 11.11.11.1
            set device "wan1"
        next
    end
  3. Configure the IPsec tunnel:

    config vpn ipsec phase1-interface
        edit "ipsec"
            set interface "wan1"
            set peertype any
            set proposal aes256-sha1
            set remote-gw 22.22.22.22
            set psksecret **********
        next
    end
    config vpn ipsec phase2-interface
        edit "ipsec"
            set phase1name "ipsec"
            set proposal aes256-sha1
            set auto-negotiate enable
        next
    end
  4. Configure the VXLAN interface and bind it to the IPsec interface:

    config system vxlan
        edit "vxlan"
            set interface "ipsec"
            set vni 10
            set remote-ip "22.22.22.22"
        next
    end

    The remote IP address is the peer side WAN IP address.

  5. Configure a virtual wire pair with the LAN and VXLAN interfaces as members:

    config system virtual-wire-pair
        edit "vwp"
            set member "port1" "vxlan"
            set wildcard-vlan enable
        next
    end

    The interfaces added to the virtual wire pair cannot be part of a switch, such as the default internal interface.

    By enabling wildcard VLANs on the virtual wire pair, all VLAN tagged traffic that is allowed by the virtual wire pair firewall policies passes through the pair.

  6. Configure a firewall policy to allow traffic between the LAN and VXLAN interfaces:

    config firewall policy
        edit 4
            set name "vwp-pol"
            set srcintf "port1" "vxlan"
            set dstintf "port1" "vxlan"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
        next
    end
To configure FGT-B in the CLI:
  1. Configure the WAN interface:

    config system interface
        edit "wan1"
            set vdom "root"
            set ip 22.22.22.22 255.255.255.0 255.255.255.0
            set allowaccess ping https ssh http fgfm
            set type physical
            set role wan
            set snmp-index 1
        next
    end
  2. Configure a static route to send all traffic out the WAN interface:

    config router static  
        edit 1
            set gateway 22.22.22.2
            set device "wan1"
        next
    end
  3. Configure the IPsec tunnel:

    config vpn ipsec phase1-interface
        edit "ipsec"
            set interface "wan1"
            set peertype any
            set proposal aes256-sha1
            set remote-gw 11.11.11.11
            set psksecret **********
        next
    end
    config vpn ipsec phase2-interface
        edit "ipsec"
            set phase1name "ipsec"
            set proposal aes256-sha1
            set auto-negotiate enable
        next
    end
  4. Configure the VXLAN interface and bind it to the IPsec interface:

    config system vxlan
        edit "vxlan"
            set interface "ipsec"
            set vni 10
            set remote-ip "11.11.11.11"
        next
    end

    The remote IP address is the peer side WAN IP address.

  5. Configure a virtual wire pair with the LAN and VXLAN interfaces as members:

    config system virtual-wire-pair
        edit "vwp"
            set member "port1" "vxlan"
            set wildcard-vlan enable
        next
    end
  6. Configure a firewall policy to allow traffic between the LAN and VXLAN interfaces:

    config firewall policy
        edit 4
            set name "vwp-pol"
            set srcintf "port1" "vxlan"
            set dstintf "port1" "vxlan"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
        next
    end

Test the configuration

To test the configuration, ping Host2 (VLAN10: 192.168.10.2/24) from Host1 (VLAN10: 192.168.10.1/24):
C:\>ping 192.168.10.2

Pinging 192.168.10.2 with 32 bytes of data:
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=11ms TTL=56

Ping statistics for 192.168.10.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 8ms, Maximum = 11ms, Average = 8ms

VXLAN over IPsec tunnel with virtual wire pair

In this example, a site-to-site VPN tunnel is formed between two FortiGates. Multiple VLANs are configured that match on each FortiGate. Host1 and Host2 are connected to VLAN10 on the switches.

To configure FGT-A in the CLI:
  1. Configure the WAN interface:

    config system interface
        edit "wan1"
            set vdom "root"
            set ip 11.11.11.11 255.255.255.0
            set allowaccess ping https ssh http fgfm
            set type physical
            set role wan
            set snmp-index 1
        next
    end
  2. Configure a static route to send all traffic out the WAN interface:

    config router static  
        edit 1
            set gateway 11.11.11.1
            set device "wan1"
        next
    end
  3. Configure the IPsec tunnel:

    config vpn ipsec phase1-interface
        edit "ipsec"
            set interface "wan1"
            set peertype any
            set proposal aes256-sha1
            set remote-gw 22.22.22.22
            set psksecret **********
        next
    end
    config vpn ipsec phase2-interface
        edit "ipsec"
            set phase1name "ipsec"
            set proposal aes256-sha1
            set auto-negotiate enable
        next
    end
  4. Configure the VXLAN interface and bind it to the IPsec interface:

    config system vxlan
        edit "vxlan"
            set interface "ipsec"
            set vni 10
            set remote-ip "22.22.22.22"
        next
    end

    The remote IP address is the peer side WAN IP address.

  5. Configure a virtual wire pair with the LAN and VXLAN interfaces as members:

    config system virtual-wire-pair
        edit "vwp"
            set member "port1" "vxlan"
            set wildcard-vlan enable
        next
    end

    The interfaces added to the virtual wire pair cannot be part of a switch, such as the default internal interface.

    By enabling wildcard VLANs on the virtual wire pair, all VLAN tagged traffic that is allowed by the virtual wire pair firewall policies passes through the pair.

  6. Configure a firewall policy to allow traffic between the LAN and VXLAN interfaces:

    config firewall policy
        edit 4
            set name "vwp-pol"
            set srcintf "port1" "vxlan"
            set dstintf "port1" "vxlan"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
        next
    end
To configure FGT-B in the CLI:
  1. Configure the WAN interface:

    config system interface
        edit "wan1"
            set vdom "root"
            set ip 22.22.22.22 255.255.255.0 255.255.255.0
            set allowaccess ping https ssh http fgfm
            set type physical
            set role wan
            set snmp-index 1
        next
    end
  2. Configure a static route to send all traffic out the WAN interface:

    config router static  
        edit 1
            set gateway 22.22.22.2
            set device "wan1"
        next
    end
  3. Configure the IPsec tunnel:

    config vpn ipsec phase1-interface
        edit "ipsec"
            set interface "wan1"
            set peertype any
            set proposal aes256-sha1
            set remote-gw 11.11.11.11
            set psksecret **********
        next
    end
    config vpn ipsec phase2-interface
        edit "ipsec"
            set phase1name "ipsec"
            set proposal aes256-sha1
            set auto-negotiate enable
        next
    end
  4. Configure the VXLAN interface and bind it to the IPsec interface:

    config system vxlan
        edit "vxlan"
            set interface "ipsec"
            set vni 10
            set remote-ip "11.11.11.11"
        next
    end

    The remote IP address is the peer side WAN IP address.

  5. Configure a virtual wire pair with the LAN and VXLAN interfaces as members:

    config system virtual-wire-pair
        edit "vwp"
            set member "port1" "vxlan"
            set wildcard-vlan enable
        next
    end
  6. Configure a firewall policy to allow traffic between the LAN and VXLAN interfaces:

    config firewall policy
        edit 4
            set name "vwp-pol"
            set srcintf "port1" "vxlan"
            set dstintf "port1" "vxlan"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
        next
    end

Test the configuration

To test the configuration, ping Host2 (VLAN10: 192.168.10.2/24) from Host1 (VLAN10: 192.168.10.1/24):
C:\>ping 192.168.10.2

Pinging 192.168.10.2 with 32 bytes of data:
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=8ms TTL=56
Reply from 192.168.10.2: bytes=32 time=11ms TTL=56

Ping statistics for 192.168.10.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 8ms, Maximum = 11ms, Average = 8ms