Starting an IPsec remote access CC test
FortiTester tests IPSec remote access tunnel concurrent connections (CC) by establishing a remote access IPSec tunnel, completes a full set of HTTP transaction (TCP connection, HTTP request, HTTP response, and TCP connection close) through the tunnel, and terminates the tunnel.
To start a remote access CC test:
- Go to Cases > Performance Testing > IPSec > Remote Access CC to display the test case summary page.
- Click + Create New to display the Select case options dialog box.
- In the popup dialog, for the Network Config option, select the network template you have created in Cases > Security Testing > Objects > Networks. Then the network related options will automatically be filled. See Using network configuration templates for how to create a network template.
- Select a Certificate Group if applicable.
- Click OK to continue.
- Configure the test case options described inTable 1 .
- Click Start to run the test case.
FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.
Below is a sample FortiGate IPsec configuration for the VPN gateway. FortiTester uses FortiTester as its ID, however in this configuration the VPN gateway uses IKE version 1 Aggressive mode, and is configured to accept any peer ID. The VPN gateway IP is configured as a secondary IP address and this is used as the local gateway in the phase 1 config.
config system interface
edit "port33"
set ip 1.0.0.254 255.255.0.0
set allowaccess ping
set secondary-IP enable
config secondaryip
edit 1
set ip 1.0.0.253 255.255.0.0
set allowaccess ping
next
end
next
end
config system interface
edit "port35"
set ip 2.0.0.254 255.255.0.0
set allowaccess ping
next
end
config vpn ipsec phase1-interface
edit "tester"
set type dynamic
set interface "port33"
set ike-version 2
set local-gw 1.0.0.253
set peertype any
set psksecret fortinet
next
end
config vpn ipsec phase2-interface
edit "tester"
set phase1name "tester"
next
end
config firewall policy
edit 1
set srcintf "any"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set logtraffic disable
next
end
|
Tip 1: You can also copy an existing case, and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case. Tip 2: You can add or edit a comment when the test is running. This comment can be used to search for the test result in the Results page. This is useful especially when the test runs for a long time. |
SSL-VPN Test Case common options
IPsec Test Case configuration specific to remote access CC
| Settings | Guidelines |
|---|---|
| Load | |
| Tunnel Concurrent Connection |
Specify the number of concurrent connections. |
| Think Time | The delay between client HTTP requests (unit: second). |