Basic site-to-site VPN with pre-shared key

This example shows how to configure a basic site-to-site IPsec tunnel between two FortiGates. This IKEv2 tunnel will use a pre-shared key to authenticate. Only traffic from the local subnets are permitted through the tunnel.

Individual options may vary. However, in order for the tunnel to come up, options configured on one FortiGate should be identical to the other. For more information on IPsec settings, see Phase 1 configuration and Phase 2 configuration.

To configure an IPsec VPN using the VPN Wizard in the GUI:

1. Configure the HQ1 FortiGate.

   1. Go to VPN > VPN Wizard and configure the following settings for VPN Setup:

      1. Enter a VPN name in the Tunnel name field. In this example, HQ2B2.

      2. From the Select a template options, select Site to Site.

      3. Click Begin.

   2. Configure the Remote Site:

      1. For Remote site device type, select FortiGate.

      2. For Remote site device, select Accessible and static.

      3. For the IP address, enter 10.100.68.5.

      4. For Remote site subnets that can access VPN, enter 10.2.0.0/24.

      5. Click Next.

   3. Configure the VPN tunnel:

      1. For Authentication Method, select Pre-shared Key.

      2. In the Pre-shared Key field, enter your key.

      3. For IKE, select Version 2.

      4. For Transport, select Auto. Leave the Use Fortinet encapsulation option toggled off.

      5. For NAT traversal, select Enable.

      6. For Keepalive frequency, enter 10.

   4. Configure the Local Site:

      1. For Outgoing interface that binds to tunnel, select the WAN interface. In this example, port1. Disable the Create and add interface to zone toggle, if you do not want a zone created.

      2. For Local Interface, select an interface from the Select Entries slide-out panel. In this example, port2.

      3. The Local subnets that can access VPN field should automatically fill with the IP address related to the selected local interface (10.100.77.0/24).

      4. Leave the Allow remote site’s internet traffic through this device toggle disabled.

      5. Click Next.

   5. Review the configuration and click Submit.

2. Configure the HQ2 FortiGate

   1. Go to VPN > VPN Wizard and configure the following settings for VPN Setup:

      1. Enter a VPN name in the Tunnel name field. In this example, B2toHQ.

      2. From the Select a template options, select Site to Site.

      3. Click Begin.

   2. Configure the Remote Site:

      1. For Remote site device type, select FortiGate.

      2. For Remote site device, select Accessible and static.

      3. For the IP address, enter 10.100.64.101.

      4. For Remote site subnets that can access VPN, enter 10.100.77.0/24.

      5. Click Next.

   3. Configure the VPN tunnel:

      1. For Authentication Method, select Pre-shared Key.

      2. In the Pre-shared Key field, enter your key.

      3. For IKE, select Version 2.

      4. For Transport, select Auto. Leave the Use Fortinet encapsulation option toggled off.

      5. For NAT traversal, select Enable.

      6. For Keepalive frequency, enter 10.

   4. Configure the Local Site:

      1. For Outgoing interface that binds to tunnel, select the WAN interface. In this example, port1. Leave the Create and add interface to zone toggle enabled.

      2. For Local Interface, select an interface from the Select Entries slide-out panel. In this example, port3.

      3. The Local subnets that can access VPN field should automatically fill with the IP address related to the selected local interface (10.2.0.0/24).

      4. Leave the Allow remote site’s internet traffic through this device toggle disabled.

      5. Click Next.

Verify the VPN tunnel configurations created in the VPN Wizard

Verify the VPN tunnel configurations for HQ1 and HQ2 created in the VPN Wizard using the CLI.

Verify the HQ1 configuration

config firewall address
    edit "HQ2B2_local_subnet_0"
        set allow-routing enable
        set subnet 10.100.77.0 255.255.255.0
    next
    edit "HQ2B2_remote_subnet_0"
        set allow-routing enable
        set subnet 10.2.0.0 255.255.255.0
    next
end

config firewall addrgrp
    edit "HQ2B2_local"
        set allow-routing enable
        set member "HQ2B2_local_subnet_0"
        set comment "VPN: HQ2B2 -- Created by VPN wizard"
    next
    edit "HQ2B2_remote"
        set allow-routing enable
        set member "HQ2B2_remote_subnet_0"
        set comment "VPN: HQ2B2 -- Created by VPN wizard"
    next
end

config vpn ipsec phase1-interface
    edit "HQ2B2"
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device disable
        set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
        set comments "VPN: HQ2B2 -- Created by VPN wizard"
        set wizard-type static-fortigate
        set remote-gw 10.100.68.5
        set psksecret ENC <encrypted key>
    next
end

config vpn ipsec phase2-interface
    edit "HQ2B2"
        set phase1name "HQ2B2"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set comments "VPN: HQ2B2 -- Created by VPN wizard"
        set src-addr-type name
        set dst-addr-type name
        set src-name "HQ2B2_local"
        set dst-name "HQ2B2_remote"
    next
end

config router static
    edit 14
        set device "HQ2B2"
        set comment "VPN: HQ2B2 -- Created by VPN wizard"
        set dstaddr "HQ2B2_remote"
    next
    edit 16
        set distance 254
        set comment "VPN: HQ2B2 -- Created by VPN wizard"
        set blackhole enable
        set dstaddr "HQ2B2_remote"
        set vrf 0
    next
end

config firewall policy
    edit 29
        set name "vpn_HQ2B2_local"
        set srcintf "port2"
        set dstintf "HQ2B2"
        set action accept
        set srcaddr "HQ2B2_local"
        set dstaddr "HQ2B2_remote"
        set schedule "always"
        set service "ALL"
        set comments "VPN: HQ2B2 -- Created by VPN wizard"
    next
    edit 32
        set name "vpn_HQ2B2_remote"
        set srcintf "HQ2B2"
        set dstintf "port2"
        set action accept
        set srcaddr "HQ2B2_remote"
        set dstaddr "HQ2B2_local"
        set schedule "always"
        set service "ALL"
        set comments "VPN: HQ2B2 -- Created by VPN wizard"
    next
end

Verify the HQ2 configuration

config firewall address
    edit "B2toHQ_local_subnet_0"
        set allow-routing enable
        set subnet 10.2.0.0 255.255.255.0
    next
    edit "B2toHQ_remote_subnet_0"
        set allow-routing enable
        set subnet 10.100.77.0 255.255.255.0
    next
end

config firewall addrgrp
    edit "B2toHQ_local"
        set allow-routing enable
        set member "B2toHQ_local_subnet_0"
        set comment "VPN: B2toHQ -- Created by VPN wizard"
    next
    edit "B2toHQ_remote"
        set allow-routing enable
        set member "B2toHQ_remote_subnet_0"
        set comment "VPN: B2toHQ -- Created by VPN wizard"
    next
end

config vpn ipsec phase1-interface
    edit "B2toHQ"
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device disable
        set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
        set comments "VPN: B2toHQ -- Created by VPN wizard"
        set wizard-type static-fortigate
        set remote-gw 10.100.64.101
        set psksecret ENC <encrypted key>
    next
end

config vpn ipsec phase2-interface
    edit "B2toHQ"
        set phase1name "B2toHQ"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set comments "VPN: B2toHQ -- Created by VPN wizard"
        set src-addr-type name
        set dst-addr-type name
        set src-name "B2toHQ_local"
        set dst-name "B2toHQ_remote"
    next
end

config firewall policy
    edit 5
        set name "vpn_B2toHQ_local"
        set uuid dbc31212-9326-51ef-fea3-ea8cb4e2a064
        set srcintf "port3"
        set dstintf "B2toHQ"
        set action accept
        set srcaddr "B2toHQ_local"
        set dstaddr "B2toHQ_remote"
        set schedule "always"
        set service "ALL"
        set comments "VPN: B2toHQ -- Created by VPN wizard"
    next
    edit 6
        set name "vpn_B2toHQ_remote"
        set uuid dbc58e3e-9326-51ef-1896-d5d2f3c1932d
        set srcintf "B2toHQ"
        set dstintf "port3"
        set action accept
        set srcaddr "B2toHQ_remote"
        set dstaddr "B2toHQ_local"
        set schedule "always"
        set service "ALL"
        set comments "VPN: B2toHQ -- Created by VPN wizard"
    next
end

config router static
    edit 7
        set device "B2toHQ"
        set comment "VPN: B2toHQ -- Created by VPN wizard"
        set dstaddr "B2toHQ_remote"
    next
    edit 9
        set distance 254
        set comment "VPN: B2toHQ -- Created by VPN wizard"
        set blackhole enable
        set dstaddr "B2toHQ_remote"
        set vrf 0
    next
end

Testing the tunnel

To verify a tunnel is established, go to Dashboard > Network and open the IPsec widget. You can also use the following CLI command to verify the tunnel is established:

# diagnose vpn ike gateway list name <tunnel>

Verify the HQ1 tunnel

1. Go to Dashboard > Network and open the IPsec widget.

2. Look for the newly created tunnel, in this example, HQ2B2, and hover the cursor over the tunnel name and observe additional details.
   

3. From the CLI, run the diagnose vpn ike gateway list name HQ2B2 command and observe the output:
   

   
   vd: root/0
   name: HQ2B2
   version: 2
   interface: port1 3
   addr: 10.100.64.101:500 -> 10.100.68.5:500
   tun_id: 10.100.68.5/::10.100.68.5
   remote_location: 0.0.0.0
   network-id: 0
   transport: UDP
   created: 852804s ago
   peer-id: 10.100.68.5
   peer-id-auth: no
   pending-queue: 0
   PPK: no
   IKE SA: created 1/11  established 1/11  time 0/820/9010 ms
   IPsec SA: created 1/21  established 1/21  time 0/433/9010 ms
   
   

   id/spi: 8895 45e69522bd784183/69be2940ae314677
   direction: responder
   status: established 77898-77898s ago = 0ms
   proposal: aes128-sha256
   child: yes
   SK_ei: 07446ef38bd406fa-18e45bec886a2bd3
   SK_er: b940f4338b27f369-7beaa308b7241a1b
   SK_ai: 61eeb720d062c70b-e606340beab6f9d5-3a4da2966373ab15-e5766540cf6c7dd1
   SK_ar: bbdd888b98dbda7b-669da7a726ce2148-3f08940f802f580c-52b6ef93f48672aa
   message-id sent/recv: 0/1783
   QKD: no
   lifetime/rekey: 86400/8231
   DPD sent/recv: 00000000/00000000
   peer-id: 10.100.68.5

HQ1 acted as the responder, and established the tunnel with remote peer 10.100.68.5 over UDP/500.

Verify the HQ2 tunnel

1. Go to Dashboard > Network and open the IPsec widget.

2. Look for the newly created tunnel, in this example, B2toHQ, and hover the cursor over the tunnel name and observe additional details.

3. From the CLI, run the diagnose vpn ike gateway list name B2toHQ command and observe the output:
   
   

   vd: root/0
   name: B2toHQ
   version: 2
   interface: port1 3
   addr: 10.100.68.5:500 -> 10.100.64.101:500
   tun_id: 10.100.64.101/::10.100.64.101
   remote_location: 0.0.0.0
   network-id: 0
   transport: UDP
   created: 853181s ago
   peer-id: 10.100.64.101
   peer-id-auth: no
   pending-queue: 0
   PPK: no
   IKE SA: created 1/11  established 1/11  time 0/5/10 ms
   IPsec SA: created 1/21  established 1/21  time 0/0/10 ms
   
   

   id/spi: 5788 45e69522bd784183/69be2940ae314677
   direction: initiator
   status: established 78281-78281s ago = 10ms
   proposal: aes128-sha256
   child: yes
   SK_ei: 07446ef38bd406fa-18e45bec886a2bd3
   SK_er: b940f4338b27f369-7beaa308b7241a1b
   SK_ai: 61eeb720d062c70b-e606340beab6f9d5-3a4da2966373ab15-e5766540cf6c7dd1
   SK_ar: bbdd888b98dbda7b-669da7a726ce2148-3f08940f802f580c-52b6ef93f48672aa
   message-id sent/recv: 1792/0
   QKD: no
   lifetime/rekey: 86400/7818
   DPD sent/recv: 00001ed7/00001ed7
   peer-id: 10.100.64.101

HQ2 acted as the initiator, and established the tunnel with remote peer 10.100.64.101 over UDP/500.

Verifying traffic flow

Send traffic from PC1 10.100.77.101 to the 10.2.0.0/24 network and verify traffic goes through.

Verify traffic on PC1 (10.100.77.101)

root@dmz-public-server:~# ping 10.2.0.7
PING 10.2.0.7 (10.2.0.7) 56(84) bytes of data.
64 bytes from 10.2.0.7: icmp_seq=1 ttl=62 time=9.84 ms
64 bytes from 10.2.0.7: icmp_seq=2 ttl=62 time=0.808 ms

Verify traffic on HQ1

In the CLI, run diagnose sniffer packet any 'host 10.2.0.7' 4 0 l and observe the output:

HQ1 # diag sniffer packet any 'host 10.2.0.7' 4 0 l
Using Original Sniffing Mode
interfaces=[any]
filters=[host 10.2.0.7]
2024-11-05 12:06:05.509027 port2 in 10.100.77.101 -> 10.2.0.7: icmp: echo request
2024-11-05 12:06:05.509074 HQ2B2 out 10.100.77.101 -> 10.2.0.7: icmp: echo request
2024-11-05 12:06:05.518607 HQ2B2 in 10.2.0.7 -> 10.100.77.101: icmp: echo reply
2024-11-05 12:06:05.518632 port2 out 10.2.0.7 -> 10.100.77.101: icmp: echo reply

The ICMP request is received on port2 and routed to the HQ2B2 tunnel. The ICMP reply is received on the HQ2B2 tunnel and routed back out port2.

Verify traffic on HQ2

In the CLI, run diagnose sniffer packet any 'host 10.100.77.101' 4 0 l and observe the output:

HQ2 # diag sniffer packet any 'host 10.100.77.101' 4 0 l
Using Original Sniffing Mode
interfaces=[any]
filters=[host 10.100.77.101]
2024-11-05 12:06:05.509711 B2toHQ in 10.100.77.101 -> 10.2.0.7: icmp: echo request
2024-11-05 12:06:05.509791 port3 out 10.100.77.101 -> 10.2.0.7: icmp: echo request
2024-11-05 12:06:05.518809 port3 in 10.2.0.7 -> 10.100.77.101: icmp: echo reply
2024-11-05 12:06:05.518899 B2toHQ out 10.2.0.7 -> 10.100.77.101: icmp: echo reply

The ICMP request is received on the B2toHQ tunnel and routed to port3. The ICMP reply is received on port3 and routed back out the B2toHQ tunnel.