Creating a fortigate vpn network & security blog
2 likes2,447 views
This document provides step-by-step instructions for creating a VPN between two Fortigate firewalls. It describes configuring Phase 1 and Phase 2 VPN settings on the Fortigates including pre-shared keys, encryption, and defining source and destination addresses for the VPN tunnel. The document also covers creating firewall policies and addresses to allow traffic to pass between the two networks connected by the Fortigate VPN.
Creating a fortigate vpn network & security blog
- 1. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ Home About Contact Cisco 損 Fortinet 損 General Security Linux News Windows Home About Contact Cisco 損 Fortinet 損 General Security Linux News Windows Home 損 Fortigate 損 Creating a Fortigate VPN Creating a Fortigate VPN Posted by Daniel on May 28, 2012 in Fortigate, Fortinet | 15 comments Like Be the first of your friends to like this. Hello, In this post i will show you how to create a policy based Fortigate VPN. I will be using FortiOS version 4.0 MR3. For the VPN tunnel we used the following topology: 1 of 9 06/04/2013 13:43
- 2. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ Creating Fortigate VPN Steps: I. Go to VPN > IPsec ->Auto Key (IKE) and select Create Phase 1 II. Enter the following information in Phase1 Name: Fortigate_VPN 1- This is a name to identify the VPN tunnel, you must remember this name as it will appear when configuration the Phase2. Remote Gateway Enter the static IP of the VPN remote peer. In our example it is 2.2.2.2 Local Interface Select the interface that has outside Internet access. In our case we picked WAN1. Note: This interface cannot be a loopback interface. Mode: Main Mode Authentication: Pre Shared Key -> pick a share key with more than 6 letters. Click Advanced: Select the P1 Proposals (we picked): Encryption: 3DES Authentication: MD5 DH Group: 2 Keylive: 28800 Local ID: <none> XAUTH: Disabled NAT Traversal: Disabled Dead Peer Detection: Disable Note:please keep in mind to set this to disabled in case you are 2 of 9 06/04/2013 13:43
- 3. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ peering with another VPN vendor. I have found out that this can break the VPN tunnel Click OK The VPN Phase1 one was now created successful. III. Now we need to create VPN Phase2, below are the steps: Name: Select a name that suits you, we picked Phase2_Fortigate_VPN1 Phase1: Select the name of the Phase1 you created earlier. We picked Fortigate_VPN1 Encryption: 3DES Authentication: MD5 Quick Mode Selector: This describes the IP ranges that you want passing through the VPN. As in the picture, we picked: The Source Address: 10.10.10.0/24 , that is behind our Fortigate_1 VPN appliance. The Destination Address: 10.20.20.0/24. that is behind our Fortigate_2 VPN appliance. IV. Define VPN Source Selectors 1. Create a firewall address, go to Firewall Objects > Addresses > Address and select Create New. Enter the following information and press OK: Address Name: Sales_Network Subnet/IP Range: 10.10.10.0/24 2. Create another firewall address( that is behind Fortigate 2) and go to Firewall Objects > Addresses > Address and select Create New. 3 of 9 06/04/2013 13:43
- 4. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ Enter the following information and press OK: Address Name: Remote_Sales_Network Subnet/IP Range: 10.20.20.0/24 V. Create a Firewall Policy on the Fortigate: a. Go to Policy > Policy b. Select Create New c. Enter the following information and press OK Source Interface/Zone Select Internal Source Address Name Select Sales_Network Destination Interface/Zone Select WAN1 Destination Address Name Remote_Sales_Network Action IPSEC VPN tunnel: Fortigate_VPN1 Select ONLY the following option: Allow Inbound and Allow Outbound Everything should be up and running now. Please let me know if you have any questions. Related Posts Fortigate Tips and Tricks Fortigate Troubleshooting VPN Like Be the first of your friends to like this. 15 Comments 1. Santosh Kumar Nayak / June 2, 2012 Can you please help me in Blocking Google+ in Fortinet Firewall? I have already blocked Social Networking but it doesnt get blocked by Firewall. 4 of 9 06/04/2013 13:43
- 5. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ Reply Daniel / June 2, 2012 Santhosh, You can create a new URL filter, or add to an existing one the plus.google.com URL and mark it as blocked. Also please be carefull that when applying the Web Filter, you also mark the inspection for HTTPS (as google plus could be using SSL). Hope it helps. Reply Santosh Kumar Nayak / June 13, 2012 Hi!!!! I tried that also, it didnt work. It works only if I set https(Deep Scan). But in this case all my websites are asking for certificates even in outlook also. Is there any other way. Reply Daniel / June 15, 2012 So you added plus.google.com as a blocked URL and it didnt work ? Please try something like this in the url filter: url: .*dropbox.com.* type: regex action: blocked enable: yes (ticked) I did not try this, but it should work. Please let me know the outcome Reply Santosh Kumar Nayak / June 18, 2012 Hi! It works for other sites. But for Google Plus it doesnt block. If I give deep scanning then it blocks as Social Networking category. But 5 of 9 06/04/2013 13:43
- 6. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ for most of the sites it is getting Certificate issues. Is there any other solutions? 2. Daniel / June 11, 2012 Hi! Very nice description. You described the settings for one Fortigate. Is it right that I have to set up the remote sales network Fortigate the same way as the sales network Fortigateunit? Thank you in advance! Reply Daniel / June 13, 2012 Well, now I can answer my question myself: YES! Reply 3. Manuel Guzman / December 19, 2012 Good morning, i have an ipsec site to site betweeen a Fortigate 100d and a cisco SA520, i can access from the network that is behind the cisco to the one that is behind the fortigate but i cant access from the one behind of fortigate to the one behind the cisco, any ideas or recommendation? Thank you Reply 4. Shabeer / February 10, 2013 I want to connect between two offices, using dyndns. In head office we already have 5 VPNs. I am new in office. Can you kindly show me what kind of configuration i can have to connect between 10.0.0.0/24 and 10.0.6.0/24 using dyndns. Reply 6 of 9 06/04/2013 13:43
- 7. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ kaleem / March 2, 2013 dear shabeer, i am also looking for same. if you got any material the. plz share with me at kaleemullahbilal@gmail.com Reply 5. James Greene / February 20, 2013 I am trying to setup a vpn tunnel to a cisco asa 5520. I get the following error: NO-PROPOSAL-CHOSEN from your side. Any help would be greatly appreciated Reply admin / February 20, 2013 Hello, That means that the Fortigate or the ASA side do not have the same encryption or source selector configured. The PHASE2 is not matching between the ASA and the Fortigate. Reply 6. Rene Bosshard / February 22, 2013 Very good and short post. I made it from a Fortigate 60b to a Zywall. I have a VPN-tunnel, but i can not ping nor access the servers behind. What is Wrong? Reply admin / March 1, 2013 I need the configuration of both firewalls to see this.. 7 of 9 06/04/2013 13:43
- 8. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ Reply 7. Daniel / July 8, 2012 Which IE browser are you using ? IE9 works fine. Reply Leave a Comment Your email address will not be published. Required fields are marked * You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> Sign up to our newsletter! Please subscribe to our weekly newsletter! Name: Email: 8 of 9 06/04/2013 13:43
- 9. Creating a Fortigate VPN | Network & Security Blog http://www.ipspace.eu/fortinet/creating-a-fortigate-vpn/ Please subscribe for our weekly newsletter. We are planning or releasing PDFs and Videos that will help you in your day-to-day Engineering job! Designed by Elegant WordPress Themes | Powered by WordPress Home About Contact 9 of 9 06/04/2013 13:43