Fortinet black logo

Handbook

Starting a IPSec remote access test

Copy Link
Copy Doc ID 1eee771d-afba-11ea-8b7d-00505692583a:633370
Download PDF

Starting an IPsec remote access test

FortiTester tests IPSec remote access by establishing a remote access IPSec tunnel, completes a full set of HTTP transactions (TCP connection, HTTP request, HTTP response, TCP connection close) through the tunnel, and terminates the tunnel.

To start a remote access test:
  1. Go to Cases > Performance Testing > IPSec > Remote Access to display the test case summary page.
  2. Click Add to display the Select case options dialog box.
  3. In the popup dialog, for the Network Config option, select the network template you have created in Cases > Security Testing > Objects > Networks. Then the network related options will automatically be filled. See Using network configuration templates for how to create a network template.
  4. Select a Certificate Group if applicable.
  5. Click OK to continue.
  6. Configure the test case options described in IPSec Remote Access Test Case configuration.
  7. Click Start to run the test case.

FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.

Below is a sample FortiGate IPsec configuration for the VPN gateway. FortiTester uses Fortitester as its ID. However, in this configuration the VPN gateway uses IKE version 1 Aggressive mode, and it is configured to accept any peer ID. The VPN gateway IP is configured as a secondary IP address, and this is used as the local gateway in the phase 1 config.

config system interface

edit "port33"

set ip 1.0.0.254 255.255.0.0

set allowaccess ping

set secondary-IP enable

config secondaryip

edit 1

set ip 1.0.0.253 255.255.0.0

set allowaccess ping

next

end

next

end

config system interface

edit "port35"

set ip 2.0.0.254 255.255.0.0

set allowaccess ping

next

end

config vpn ipsec phase1-interface

edit "tester"

set type dynamic

set interface "port33"

set ike-version 2

set local-gw 1.0.0.253

set peertype any

set psksecret fortinet

next

end

config vpn ipsec phase2-interface

edit "tester"

set phase1name "tester"

next

end

config firewall policy

edit 1

set srcintf "any"

set dstintf "any"

set srcaddr "all"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

set logtraffic disable

next

end

Tip: You can also copy an existing case, and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case.

IPSec Remote Access Test Case configuration

Settings Guidelines
Basic Information
Name Specify the case name, or just use the default. The name appears in the list of test cases.
Ping Server Timeout If a FortiTester connects to a DUT via a switch, the switch might cause a ping timeout, resulting in the test case failing to run. If this occurs, increase the timeout. The default is 15 seconds. The valid range is 0 to 600.
Note: You can disable this end-to-end connectivity test by entering a setting of 0. If the DUT is unable to return packets, it is recommended you do so.
Number of Samples Select the number of samples. The default is 20, which means the web UI will show the last 20 sample data (about 20 seconds) in the test case running page. You can select 20, 60, or 120.

Script Config

Select the script that will run before/after the test. To create a script, see Using script object templates.

Steady Duration Specify the test duration. The default is 10 minutes. The test stops automatically after the duration you specify.
Stopping Status in Second The maximum time out in seconds allotted for FortiTester to close all TCP connections after the test finishes.

DNS Host Group

Select the DNS host group to look up the IP address of a domain name. To create a DNS host group, see Creating DNS host group.

DUT Monitor

Select to monitor a FortiGate device under test (DUT). If selected, you can monitor the DUT from the DUT Monitor tab on the management interface. To create a DUT monitoring, see Using DUT monitoring.

Network Settings
If you have selected a network config template, the network settings automatically inherit the configurations in the template. See Using network configuration templates for the description of network settings.
Load
Simulated Users Number of users to simulate.
IKE Version Select either version 1 or 2. For 1, configure IKE Mode and XAUTH.
Authentication Method Select either PSK (Pre-shared Key) or Signature. If using a Signature you will need to import a client and server certificate.
Pre-shared Key The parameter of IPsec.
Local Certificate Select either of the certificates. If you have selected a certificate group in the Select case options window, then you are not allowed to select local certificate here.
Remote Certificate Select either of the certificates. If you have selected a certificate group in the Select case options window, then you are not allowed select remote certificate here.
Client Profile
Source Port Range Specify a client port range. The valid range is 10,000 to 65,535, which is also the default.
IP Change Algorithm/Port Change Algorithm Select a change algorithm: Increment or Random. This setting determines how the system changes source/destination IP addresses and ports to simulate multiple client requests. The Increment option uses the next IP address or port in the range, for example: 10.11.12.1 -> 10.11.12.2; port 10000 -> 10001. The Random option selects an IP address or port in the range randomly.
Server Profile
Case Server Port The server port where the test case traffic arrives.
Client/Server Network
Network MTU The maximum transmission unit size.
Action
Request Page Select System Pages with Fixed or Random File Name and Content.

Starting an IPsec remote access test

FortiTester tests IPSec remote access by establishing a remote access IPSec tunnel, completes a full set of HTTP transactions (TCP connection, HTTP request, HTTP response, TCP connection close) through the tunnel, and terminates the tunnel.

To start a remote access test:
  1. Go to Cases > Performance Testing > IPSec > Remote Access to display the test case summary page.
  2. Click Add to display the Select case options dialog box.
  3. In the popup dialog, for the Network Config option, select the network template you have created in Cases > Security Testing > Objects > Networks. Then the network related options will automatically be filled. See Using network configuration templates for how to create a network template.
  4. Select a Certificate Group if applicable.
  5. Click OK to continue.
  6. Configure the test case options described in IPSec Remote Access Test Case configuration.
  7. Click Start to run the test case.

FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.

Below is a sample FortiGate IPsec configuration for the VPN gateway. FortiTester uses Fortitester as its ID. However, in this configuration the VPN gateway uses IKE version 1 Aggressive mode, and it is configured to accept any peer ID. The VPN gateway IP is configured as a secondary IP address, and this is used as the local gateway in the phase 1 config.

config system interface

edit "port33"

set ip 1.0.0.254 255.255.0.0

set allowaccess ping

set secondary-IP enable

config secondaryip

edit 1

set ip 1.0.0.253 255.255.0.0

set allowaccess ping

next

end

next

end

config system interface

edit "port35"

set ip 2.0.0.254 255.255.0.0

set allowaccess ping

next

end

config vpn ipsec phase1-interface

edit "tester"

set type dynamic

set interface "port33"

set ike-version 2

set local-gw 1.0.0.253

set peertype any

set psksecret fortinet

next

end

config vpn ipsec phase2-interface

edit "tester"

set phase1name "tester"

next

end

config firewall policy

edit 1

set srcintf "any"

set dstintf "any"

set srcaddr "all"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

set logtraffic disable

next

end

Tip: You can also copy an existing case, and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case.

IPSec Remote Access Test Case configuration

Settings Guidelines
Basic Information
Name Specify the case name, or just use the default. The name appears in the list of test cases.
Ping Server Timeout If a FortiTester connects to a DUT via a switch, the switch might cause a ping timeout, resulting in the test case failing to run. If this occurs, increase the timeout. The default is 15 seconds. The valid range is 0 to 600.
Note: You can disable this end-to-end connectivity test by entering a setting of 0. If the DUT is unable to return packets, it is recommended you do so.
Number of Samples Select the number of samples. The default is 20, which means the web UI will show the last 20 sample data (about 20 seconds) in the test case running page. You can select 20, 60, or 120.

Script Config

Select the script that will run before/after the test. To create a script, see Using script object templates.

Steady Duration Specify the test duration. The default is 10 minutes. The test stops automatically after the duration you specify.
Stopping Status in Second The maximum time out in seconds allotted for FortiTester to close all TCP connections after the test finishes.

DNS Host Group

Select the DNS host group to look up the IP address of a domain name. To create a DNS host group, see Creating DNS host group.

DUT Monitor

Select to monitor a FortiGate device under test (DUT). If selected, you can monitor the DUT from the DUT Monitor tab on the management interface. To create a DUT monitoring, see Using DUT monitoring.

Network Settings
If you have selected a network config template, the network settings automatically inherit the configurations in the template. See Using network configuration templates for the description of network settings.
Load
Simulated Users Number of users to simulate.
IKE Version Select either version 1 or 2. For 1, configure IKE Mode and XAUTH.
Authentication Method Select either PSK (Pre-shared Key) or Signature. If using a Signature you will need to import a client and server certificate.
Pre-shared Key The parameter of IPsec.
Local Certificate Select either of the certificates. If you have selected a certificate group in the Select case options window, then you are not allowed to select local certificate here.
Remote Certificate Select either of the certificates. If you have selected a certificate group in the Select case options window, then you are not allowed select remote certificate here.
Client Profile
Source Port Range Specify a client port range. The valid range is 10,000 to 65,535, which is also the default.
IP Change Algorithm/Port Change Algorithm Select a change algorithm: Increment or Random. This setting determines how the system changes source/destination IP addresses and ports to simulate multiple client requests. The Increment option uses the next IP address or port in the range, for example: 10.11.12.1 -> 10.11.12.2; port 10000 -> 10001. The Random option selects an IP address or port in the range randomly.
Server Profile
Case Server Port The server port where the test case traffic arrives.
Client/Server Network
Network MTU The maximum transmission unit size.
Action
Request Page Select System Pages with Fixed or Random File Name and Content.