Site-to-site IPsec VPN with two FortiGates

Facebooktwittergoogle_pluslinkedinFacebooktwittergoogle_pluslinkedin

In this recipe, you create a site-to-site IPsec VPN tunnel to allow communication between two networks that are located behind different FortiGates. You use the VPN Wizard’s Site to Site – FortiGate template to create the VPN tunnel on both FortiGates.

In this example, one FortiGate is called HQ and the other is called Branch.

Find this recipe for other FortiOS versions
5.2 | 5.4 | 5.6 | 6.0

1. Configuring the IPsec VPN on HQ

To create a new IPsec VPN tunnel, connect to HQ, go to VPN > IPsec Wizard, and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site, set Remote Device Type to FortiGate, and set NAT Configuration to No NAT between sites.

In the Authentication step, set IP Address to the public IP address of the Branch FortiGate (in the example, 172.25.177.46).

After you enter the IP address, the wizard automatically assigns an interface as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Set a secure Pre-shared Key.

In the Policy & Routing step, set Local Interface to lan. The wizard adds the local subnet automatically. Set Remote Subnets to the Branch network’s subnet (in the example, 192.168.13.0/24).

Set Internet Access to None.

A summary page shows the configuration created by the wizard, including interfaces, firewall addresses, routes, and policies.

To view the VPN interface created by the wizard, go to Network > Interfaces.

To view the firewall addresses created by the wizard, go to Policy & Objects > Addresses.

To view the routes created by the wizard, go to Network > Static Routes.

To view the policies created by the wizard, go to Policy & Objects > IPv4 Policy.

2. Configuring the IPsec VPN on Branch

To create a new IPsec VPN tunnel, connect to Branch, go to VPN > IPsec Wizard, and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site, set Remote Device Type to FortiGate, and set NAT Configuration to No NAT between sites.

In the Authentication step, set IP Address to the public IP address of the HQ FortiGate (in the example, 172.25.176.62).

After you enter the IP address, the wizard automatically assigns an interface as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Set the secure Pre-shared Key that was used for the VPN on HQ.

In the Policy & Routing step, set Local Interface to lan. The wizard adds the local subnet automatically. Set Remote Subnets to the HQ network’s subnet (in the example, 192.168.65.0/24).

Set Internet Access to None.

A summary page shows the configuration created by the wizard, including interfaces, firewall addresses, routes, and policies.

To bring the VPN tunnel up, go to Monitor > IPsec Monitor. Right-click under Status and select Bring Up.

3. Results

Users on the HQ internal network can access resources on the Branch internal network and vice versa.

To test the connection, ping HQ’s LAN interface from a device on the Branch internal network.

Victoria Martin

Victoria Martin

Technical Writer at Fortinet
Victoria Martin works in Ottawa as part of the FortiOS technical documentation team. She graduated with a Bachelor's degree from Mount Allison University, after which she attended Humber College's book publishing program, followed by the more practical technical writing program at Algonquin College. She does need glasses but also likes wearing them, since glasses make you look smarter.
Victoria Martin

Latest posts by Victoria Martin (see all)

Facebooktwittergoogle_pluslinkedinFacebooktwittergoogle_pluslinkedin
  • Was this helpful?
  • Yes   No