Powered by Blogger.

Redundant route-based VPN configuration example

This example demonstrates a fully redundant site-to-site VPN configuration using route-based VPNs. At each site, the FortiGate unit has two interfaces connected to the Internet through different ISPs. This means that there are four possible paths for communication between the two units. In this example, these paths, listed in descending priority, are:
  • FortiGate_1 WAN 1 to FortiGate_2 WAN 1
  • FortiGate_1 WAN 1 to FortiGate_2 WAN 2
  • FortiGate_1 WAN 2 to FortiGate_2 WAN 1
  • FortiGate_1 WAN 2 to FortiGate_2 WAN 2
Example redundant route-based VPN configuration
For each path, VPN configuration, security policies and routing are defined. By specifying a different routing distance for each path, the paths are prioritized. A VPN tunnel is established on each path, but only the highest priority one is used. If the highest priority path goes down, the traffic is automatically routed over the next highest priority path. You could use dynamic routing, but to keep this example simple, static routing is used.

Configuring FortiGate_1

When configuring FortiGate_1, you must:
  • Configure the interfaces involved in the VPN.
  • Define the Phase 1 configuration for each of the four possible paths, creating a virtual IPsec interface for each one.
  • Define the Phase 2 configuration for each of the four possible paths.
  • Configure routes for the four IPsec interfaces, assigning the appropriate priorities.
  • Configure incoming and outgoing security policies between the internal interface and each of the virtual IPsec interfaces.
To configure the network interfaces
  1. Go to System > Network > Interfaces.
  2. Select the Internal interface and select Edit.
  3. Enter the following information and then select OK:
Addressing modeManual
IP/Netmask10.21.101.0/255.255.255.0
  1. Select the WAN1 interface and select Edit, enter the following information and then select OK:
Addressing modeManual
IP/Netmask192.168.10.2/255.255.255.0
  1. Select the WAN2 interface and select Edit, enter the following information and then select OK:
Addressing modeManual
IP/Netmask172.16.20.2/255.255.255.0
To configure the IPsec interfaces (Phase 1 configurations)
  1. Go to VPN > IPsec > Tunnels and create the new custom tunnel or edit an existing tunnel.
  2. Edit the Phase 1 Proposal (if it is not available, you may need to click the Convert to Custom Tunnel button).
  3. Enter the following information, and select OK:
NameSite_1_A
Remote GatewayStatic IP Address
IP Address192.168.20.2
Local InterfaceWAN1
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
  1. Create a new tunnel and enter the following Phase 1 information:
NameSite_1_B
Remote GatewayStatic IP Address
IP Address172.16.30.2
Local InterfaceWAN1
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
  1. Create a new tunnel and enter the following Phase 1 information:
NameSite_1_C
Remote GatewayStatic IP Address
IP Address192.168.20.2
Local InterfaceWAN2
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
  1. Create a new tunnel and enter the following Phase 1 information:
NameSite_1_D
Remote GatewayStatic IP Address
IP Address172.16.30.2
Local InterfaceWAN2
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
To define the Phase 2 configurations for the four VPNs
  1. Open the Phase 2 Selectors panel.
  2. Enter the following information and select OK:
NameRoute_A
Phase 1Site_1_A
  1. Enter the following Phase 2 information for the subsequent route:
NameRoute_B
Phase 1Site_1_B
  1. Enter the following Phase 2 information for the subsequent route:
NameRoute_C
Phase 1Site_1_C
  1. Enter the following Phase 2 information for the subsequent route:
NameRoute_D
Phase 1Site_1_D
To configure routes
  1. Go to Router > Static > Static Routes.
    For low-end FortiGate units, go to System > Network > Routing.
  2. Select Create New, enter the following default gateway information and then select OK:
Destination IP/Mask0.0.0.0/0.0.0.0
DeviceWAN1
Gateway192.168.10.1
Distance (Advanced)10
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.31.101.0/255.255.255.0
DeviceSite_1_A
Distance (Advanced)1
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.31.101.0/255.255.255.0
DeviceSite_1_B
Distance (Advanced)2
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.31.101.0/255.255.255.0
DeviceSite_1_C
Distance (Advanced)3
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.31.101.0/255.255.255.0
DeviceSite_1_D
Distance (Advanced)4
To configure security policies
  1. Go to Policy & Objects > Policy > IPv4 and select Create New.
  2. Enter the following information, and then select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_1_A
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_1_A
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_1_B
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_1_B
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_1_C
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_1_C
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_1_D
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_1_D
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT

Configuring FortiGate_2

The configuration for FortiGate_2 is very similar to that of FortiGate_1. You must:
  • Configure the interfaces involved in the VPN.
  • Define the Phase 1 configuration for each of the four possible paths, creating a virtual IPsec interface for each one.
  • Define the Phase 2 configuration for each of the four possible paths.
  • Configure routes for the four IPsec interfaces, assigning the appropriate priorities.
  • Configure incoming and outgoing security policies between the internal interface and each of the virtual IPsec interfaces.
To configure the network interfaces
  1. Go to System > Network > Interfaces.
  2. Select the Internal interface and then select Edit. Enter the following information and then select OK:
Addressing modeManual
IP/Netmask10.31.101.0/255.255.255.0
  1. Select the WAN1 interface and then select Edit. Enter the following information and then select OK:
Addressing modeManual
IP/Netmask192.168.20.2/255.255.255.0
  1. Select the WAN2 interface and then select Edit. Enter the following information and then select OK:
Addressing modeManual
IP/Netmask172.16.30.2/255.255.255.0
To configure the IPsec interfaces (Phase 1 configurations)
  1. Go to VPN > IPsec > Tunnels and create the new custom tunnel or edit an existing tunnel.
  2. Edit the Phase 1 Proposal (if it is not available, you may need to click the Convert to Custom Tunnel button).
  3. Enter the following information, and select OK:
NameSite_2_A
Remote GatewayStatic IP Address
IP Address192.168.10.2
Local InterfaceWAN1
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
  1. Create a new tunnel and enter the following Phase 1 information:
NameSite_2_B
Remote GatewayStatic IP Address
IP Address172.16.20.2
Local InterfaceWAN1
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
  1. Create a new tunnel and enter the following Phase 1 information:
NameSite_2_C
Remote GatewayStatic IP Address
IP Address192.168.10.2
Local InterfaceWAN1
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
  1. Create a new tunnel and enter the following Phase 1 information:
NameSite_2_D
Remote GatewayStatic IP Address
IP Address172.16.20.2
Local InterfaceWAN1
ModeMain
Authentication MethodPreshared Key
Pre-shared KeyEnter the preshared key.
Peer OptionsAny peer ID
Advanced 
Dead Peer DetectionSelect
To define the Phase 2 configurations for the four VPNs
  1. On the first VPN route, open the Phase 2 Selectors panel.
  2. Enter the following information and select OK:
NameRoute_A
Phase 1Site_2_A
  1. Enter the following Phase 2 information for the subsequent route:
NameRoute_B
Phase 1Site_2_B
  1. Enter the following Phase 2 information for the subsequent route:
NameRoute_C
Phase 1Site_2_C
  1. Enter the following Phase 2 information for the subsequent route:
NameRoute_D
Phase 1Site_2_D
To configure routes
  1. Go to Router > Static > Static Routes.

    For low-end FortiGate units, go to System > Network > Routing.
  2. Select Create New, enter the following default gateway information and then select OK:
Destination IP/Mask0.0.0.0/0.0.0.0
DeviceWAN1
Gateway192.168.10.1
Distance (Advanced)10
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.21.101.0/255.255.255.0
DeviceSite_2_A
Distance (Advanced)1
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.21.101.0/255.255.255.0
DeviceSite_2_B
Distance (Advanced)2
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.21.101.0/255.255.255.0
DeviceSite_2_C
Distance (Advanced)3
  1. Select Create New, enter the following information and then select OK:
Destination IP/Mask10.21.101.0/255.255.255.0
DeviceSite_2_D
Distance (Advanced)4
To configure security policies
  1. Go to Policy & Objects > Policy > IPv4 and select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_2_A
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_2_A
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_2_B
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_2_B
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_2_C
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_2_C
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceInternal
Source AddressAll
Outgoing InterfaceSite_2_D
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming InterfaceSite_2_D
Source AddressAll
Outgoing InterfaceInternal
Destination AddressAll
ScheduleAlways
ServiceAny
ActionACCEPT
    Blogger Comment
    Facebook Comment