Technical Tip: How to configure policy-based IPsec VPN Tunnel

Description

This article describes the configuration of a policy-based IPsec tunnel with FortiGate's GUI, where both sides have static IP.

Scope

FortiGate operating in NGFW mode, Profile-based.

Solution

Steps to configure policy-based IPsec tunnel:

 
Configure FotiGate1:

Step 1: Enable policy based IPsec VPN:

Enable 'Policy based IPsec VPN' under System -> Feature Visibility.

This can be enabled by using the following commands:

config system settings
    set gui-policy-based-ipsec enable
end

Step 2: Configure Policy-Based VPN Tunnel:

GUI:

Navigate to VPN -> IPsec Tunnels, select 'Create new', then select 'Custom', and uncheck 'Enable IPsec Interface Mode'.

Note: 
Creating Policy-Based VPN in no longer supported in the GUI, it can only be done from CLI.

In the CLI, create the Policy-Based VPN:

For example:

config vpn ipsec phase1
    edit "test-ipsec"
        set interface "port2"
        set peertype any
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set remote-gw 1.2.3.4
        set psksecret ENC
    next
end
config vpn ipsec phase2
    edit "test-ipsec"
        set phase1name "test-ipsec"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
    next
end

Step 3:
Create a new policy, Policy & Objects -> Firewall Policy.
Select Create new. Specify the incoming port (LAN) and the outgoing port (interface to which the tunnel is attached).
Specify source and destination. Select Action as 'IPsec' and select the tunnel created earlier from the dropdown menu.

If needed, enable 'Allow traffic to be initiated from the remote site'.
By default, only traffic initiated from the local network is allowed by the policy.
When the option 'Allow traffic to be initiated from the remote site' is enabled, the session initiated from the remote VPN peer network can also be accepted.
Both options can be activated simultaneously for bi-directional tunnel initiation.

In order to enable 'Allow traffic to be initiated from the remote site' from the CLI, these commands can be used:

config firewall policy
    edit <ID>
        set inbound enable
    next
end

In most cases, the IPsec tunnel will be configured with the internet (WAN) facing interface; in that case default route will already be configured, so no extra route needs to be configured.

Note: 
If the tunnel is not showing in the VPN tunnel list, one possible cause is that the destination interface in the firewall policy and the source interface in the VPN tunnel were not the same. 

Step 4: Configure FortiGate2 following the same steps:

Remote firewall can also be configured in interface-based mode or policy-based IPsec VPN (vice-versa) on either side.

Step 5: Ensure both FortiGate has default route to the WAN interface that the tunnel is configured on:

(For Policy Based tunnel, there will be no tunnel interface created, hence there is no route to the tunnel itself)

Troubleshooting:

Flow debug example:

diagnose debug reset
diagnose debug flow filter addr 192.168.200.2
diagnose debug flow filter proto 1
diagnose debug console timestamp enable
diagnose debug flow trace start 999
diagnose debug enable

Sniffer example: 

diagnose sniffer packet any 'host 192.168.100.2 and host 192.168.200.2 and icmp' 4 0 l

Tip:
There are some limitations to using a policy-based IPsec tunnel. 

SSL VPN interface cannot be used with policy-based IPsec tunnels. If this is a requirement, consider using a Route (Interface) Based VPN.

The destination address should not be blackholed, as otherwise it won't be sent out to the tunnel interface :

 
id=25461 trace_id=79 func=print_pkt_detail line=6019 msg="vd-Root:1 received a packet(proto=17, 192.168.2.45:2546->10.10.2.31:5060) tun_id=0.0.0.0 from Port2"
id=25461 trace_id=79 func=init_ip_session_common line=6220 msg="allocate a new session-f4e814ea"
id=25461 trace_id=79 func=iprope_dnat_check line=5492 msg="in-[Port2], out-[]"
id=25461 trace_id=79 func=iprope_dnat_tree_check line=824 msg="len=0"
id=25461 trace_id=79 func=iprope_dnat_check line=5517 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=25461 trace_id=79 func =__ vf_ip_route_input_rcu line=1989 msg="find a route: flag=00000000 gw-0.0.0.0 via WAN"
id=25461 trace_id=80 func=print_pkt_detail line=6019 msg="vd-Root:1 received a packet(proto=17, 192.168.2.45:2947->10.10.2.31:5060) tun_id=0.0.0.0 from Port2"

Note:
If the FortiGate's NGFW mode is set to Policy-based, 'Policy-based IPsec VPN' is not available under 'Feature visibility', and VPN can only be configured as a Route-based VPN.

Related documents:

Types of VPNs

Policy-based IPsec tunnel