Starting an IPsec remote access CC test

FortiTester tests IPSec remote access tunnel concurrent connections (CC) by establishing a remote access IPSec tunnel, completes a full set of HTTP transaction (TCP connection, HTTP request, HTTP response, and TCP connection close) through the tunnel, and terminates the tunnel.

To start a remote access CC test:

1. Go to Cases > Performance Testing > IPSec > Remote Access CC to display the test case summary page.
2. Click + Create New to display the Select case options dialog box.
3. In the popup dialog, for the Network Config option, select the network template you have created in Cases > Security Testing > Objects > Networks. Then the network related options will automatically be filled. See Using network configuration templates for how to create a network template.
4. Select a Certificate Group if applicable.
5. Click OK to continue.
6. Configure the test case options described inTable 1 .
7. Click Start to run the test case.

FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.

Below is a sample FortiGate IPsec configuration for the VPN gateway. FortiTester uses FortiTester as its ID, however in this configuration the VPN gateway uses IKE version 1 Aggressive mode, and is configured to accept any peer ID. The VPN gateway IP is configured as a secondary IP address and this is used as the local gateway in the phase 1 config.

config system interface

edit "port33"

set ip 1.0.0.254 255.255.0.0

set allowaccess ping

set secondary-IP enable

config secondaryip

edit 1

set ip 1.0.0.253 255.255.0.0

set allowaccess ping

next

end

next

end

config system interface

edit "port35"

set ip 2.0.0.254 255.255.0.0

set allowaccess ping

next

end

config vpn ipsec phase1-interface

edit "tester"

set type dynamic

set interface "port33"

set ike-version 2

set local-gw 1.0.0.253

set peertype any

set psksecret fortinet

next

end

config vpn ipsec phase2-interface

edit "tester"

set phase1name "tester"

next

end

config firewall policy

edit 1

set srcintf "any"

set dstintf "any"

set srcaddr "all"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

set logtraffic disable

next

end

Tip 1: You can also copy an existing case, and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case. Tip 2: You can add or edit a comment when the test is running. This comment can be used to search for the test result in the Results page. This is useful especially when the test runs for a long time.

SSL-VPN Test Case common options

IPsec Test Case configuration specific to remote access CC

Settings	Guidelines
Load
Tunnel Concurrent Connection	Specify the number of concurrent connections.
Think Time	The delay between client HTTP requests (unit: second).