BGP over a dynamic IPsec VPN (Expert)

Facebooktwittergoogle_plusredditpinterestlinkedinFacebooktwittergoogle_plusredditpinterestlinkedin

This example shows how to create a dynamic IPsec VPN tunnel and allowing BGP peering through it.

1. Configuring IPsec in FortiGate 1

Go to Policy & Objects > Objects > Addresses and select create new Address.

Then create Address Group.

Go to System > Status to look for CLI Console widget and create phase 1.

 config vpn ipsec phase1-interface
    edit Dialup
        set type dynamic
        set interface wan1
        set mode aggressive
        set peertype one
        set mode-cfg enable
        set proposal 3des-sha1 aes128-sha1
        set peerid dial
        set assign-ip disable
        set psksecret
    next
end

Create phase 2.

 config vpn ipsec phase2-interface
    edit dial_p2
        set phase1name Dialup
        set proposal 3des-sha1 aes128-sha1
        set src-addr-type name
        set dst-addr-type name
        set src-name all
        set dst-name VPN_DST
    next
end

2. Configuring BGP in FortiGate 1

Go to System > Network > Interfaces and create a Loopback interface.

 

Go to System > Status to look for CLI Console widget and create BGP route.

 config router bgp
    set as 100
    set router-id 1.1.1.1
        config neighbor
            edit 10.10.10.10
                set ebgp-enforce-multihop enable
                set remote-as 200
                set update-source loop
            next
        end
        config redistribute connected
            set status enable
        end
end

 3. Adding policies in FortiGate 1

 

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.

 
 

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.

 

4. Configuring IPSec in FortiGate 2

Go to System > Status to look for CLI Console widget and create phase 1.

config vpn ipsec phase1-interface
    edit Dialup
        set interface wan1
        set mode aggressive
        set mode-cfg enable
        set proposal 3des-sha1 aes128-sha1
        set localid dial
        set remote-gw 172.20.120.22
        set assign-ip disable
        set psksecret
    next
end

Create phase 2.

 config vpn ipsec phase2-interface
    edit dial_p2
        set phase1name Dialup
        set proposal 3des-sha1 aes128-sha1
        set keepalive enable
    next
end

5. Configuring BGP in FortiGate 2

Go to System > Network > Interfaces and create a Loopback interface.

Go to System > Status to look for CLI Console widget and create BGP route.

 config router bgp
    set as 200
    set router-id 1.1.1.2
        config neighbor
            edit 20.20.20.20
                set ebgp-enforce-multihop enable
                set remote-as 100
                set update-source loop
            next
        end
        config redistribute connected
            set status enable
        end
end

6. Adding policies in FortiGate 2

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.

7. Adding a static route in FortiGate 2

Go to Router > Static > Static Routes and add a route to the remote Loopback interface via Dialup interface.

8. Verifying tunnel is UP

Go to VPN > Monitor > IPsec Monitor to verify that the tunnel is UP.

 9. Results

 

From FortiGate 1, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 2 were successfully advertised to FortiGate 1 via BGP.

 
From FortiGate 1,

Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.

get router info bgp summary
BGP router identifier 1.1.1.1, local AS number 100
BGP table version is 8
2 BGP AS-PATH entries
0 BGP community entries
Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd

10.10.10.10     4        200    8257    8237        7    0    0 5d00h01m        4
Total number of neighbors 1

From FortiGate 2, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 1 were successfully advertised to FortiGate 2 via BGP.

 
From FortiGate 2,

Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.

get router info bgp summary
BGP router identifier 1.1.1.2, local AS number 200
BGP table version is 11
2 BGP AS-PATH entries
0 BGP community entries
Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd

20.20.20.20     4        100    8341    8361       10    0    0 5d01h32m        3
Total number of neighbors 1

 

For further reading, check out IPsec VPN and Border Gateway Protocol (BGP) in the FortiOS 5.2 Handbook.

 

Taher Elbar

Taher Elbar

Technical Product Specialist at Fortinet
After a Bachelor degree in Telecommunications from university of Geneva, Taher began his career in software development, then moved to System/Network administration followed by Security Support Engineer. With over 10 years of experience, Taher is writing various Technical documentation for Fortinet.
Taher Elbar
  • Was this helpful?
  • Yes   No
  • Archana Nair

    Explaining things by diagrams always work, and BGP Training should be given by diagrams as it easy to understand. Good post.

    • Victoria Martin

      Hello, Archana, I’m glad you found the recipe useful!

  • packetguy

    Why are the BGP peers communicating using the presumable public WAN addresses? Won’t that bring up the tunnel across the Internet in the clear, rather than through the VPN? Or is the intention only to use iBGP (since the peers are both in the same AS) to distribute private routing information for VPN traffic?

    • telbar

      Hello,

      BGP peers should communicate through IPsec interfaces and not WAN interfaces, the recipe should be fixed when FortiOS 5.2.2 comes out. This because of a bug id=0254898.
      Thank you,
      Taher.

      • packetguy

        That bug, 0254898, refers to only DHCP over IPSec scenarios. There is no DHCP in this case, so I’m not sure how the bug applies. To get bgp to traverse the tunnel, don’t the peering addresses have to be in the private IP subnets specified by the tunnels, the 192.168.1.x and 10.10.1.x?

        • telbar

          The recipe present BGP over dynamic IPsec vpn, dynamic IPsec vpn uses a DHCP in one site, the bug id 0254898 reflect this. I know the recipe has to be fixed. We will removed now and published once it’s fixed.
          Thank you,
          Taher.

          • telbar

            fixed

        • telbar

          Recipe is now fixed.

          Thank you,
          Taher.