Starting an IPsec Remote Access test

FortiTester tests IPSec remote access by establishing a remote access IPSec tunnel, completes a full set of HTTP transactions (TCP connection, HTTP request, HTTP response, TCP connection close) through the tunnel, and terminates the tunnel.

To start an IPsec Remote Access test:

1. In Performance testing, expand IPsec and click Remote Access.
2. Click Create New.
3. Configure the network or select a network template. See Using network configuration templates for how to create a network template.
4. Select a Certificate Group, if applicable.
5. Click OK.
6. Configure the test case options described below.
7. Click Start to run the test case.

FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.

Below is a sample FortiGate IPsec configuration for the VPN gateway. FortiTester uses Fortitester as its ID. However, in this configuration the VPN gateway uses IKE version 1 Aggressive mode, and it is configured to accept any peer ID. The VPN gateway IP is configured as a secondary IP address, and this is used as the local gateway in the phase 1 config.

config system interface
    edit "port33"
        set ip 1.0.0.254 255.255.0.0
        set allowaccess ping
        set secondary-IP enable
        config secondaryip
            edit 1
                set ip 1.0.0.253 255.255.0.0
                set allowaccess ping
            next
        end
    next
end
config system interface
    edit "port35"
        set ip 2.0.0.254 255.255.0.0
        set allowaccess ping
    next
end
config vpn ipsec phase1-interface
    edit "tester"
        set type dynamic
        set interface "port33"
        set ike-version 2
        set local-gw 1.0.0.253
        set peertype any
        set psksecret fortinet
    next
end
config vpn ipsec phase2-interface
    edit "tester"
        set phase1name "tester"
    next
end
config firewall policy
    edit 1
        set srcintf "any"
        set dstintf "any"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic disable
    next
end

Tip 1: You can copy an existing case and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case. Tip 2: You can add or edit a comment when the test is running. This comment can be used to search for the test result in the Results page. This is useful especially when the test runs for a long time.

IPsec Remote Access test case options

For details about the common options for IPsec cases, see VPN test case common options.