Solution | Create Branch-On-Ramp (BOR) on FortiSASE as per standard guide:
Follow the guidelines in public documentation, Branch On-Ramp (BOR).  Edit the Branch-On-Ramp location desired adding the VeloCloud IPsec configuration:
The steps below were tested and documented as working. Note that some parameters are mandatory. A table is provided in the next section to map the matching between VeloCloud/Arista and the FortiSASE side.
In the FortiSASE GUI, go to Operation -> On-ramp tunnel, select On-ramp security PoPs and select and Edit the desired security POP.
Create a new IPsec tunnel configuration by selecting Create.
Name: Define a unique name (it must be different from any other IPsec tunnel name, on the entire FortiSASE tenant). Tunnel interface IP: Assign an IP address, NOT within the BGP address space defined in Network -> BGP. Mode config: Set it to Disabled - VeloCloud is not supposed to get an interface tunnel IP from FortiSASE. IP assignment: Ignore this section - config mode has been disabled. Subnet mask: Ignore this section - config mode has been disabled. Pre-shared key: Insert the common pre-shared key. Peer ID: Set it to Any so that any VeloCloud IPsec peer can be terminated on this tunnel interface. If required, this setting can be modified in a later stage to accept specific peers on specific IPsec tunnel interface configuration profiles. Default network ID: Can be left to default, which is 0.
See the screenshot below:
Expand and edit the Phase1 parameters as follows:
Encryption - authentication: Use SHA256-AES256 which is the default value on VeloCloud. Diffie-Hellman groups:Â Use the combination below, for maximum compatibility: 2,5,14. Note that 5 is the default value on VeloCloud. Local ID: Insert the on-ramp POP IP public address here. Note that VeloCloud will not accept FQDN, so the actual valid IP address must be inserted.
Expand and edit the Phase2 parameters as follows:
Remote subnets(s): Add the VeloCloud/Arista LAN side networks here. Note that supernetworks can be used: a /16 here is used, that contains many subnetworks /24 coming from each IPsec Tunnel. Automatically create static routes: This setting can be left as default. Encryption - authentication: Use SHA256-AES256, which is the default value on VeloCloud. Perfect forward secrecy: Set it to Enabled. Diffie-Hellman groups: Use the combination below, for maximum compatibility: 2,5,14. Note that 5 is the default value on VeloCloud.
Continue the configuration for the incoming traffic by editing the necessary policies, under Security -> TRAFFIC -> Policies:
Edit the configuration on VeloCloud/Arista portal:
Some of the parameters on FortiSASE and VeloCloud must match to permit the correct IPsec tunnel setup, so verify the VeloCloud configuration:
Go to Network Services and add a new profile in Cloud Security Services:
Insert the following parameters:
Service Name *: A valid name that will be used to identify the newly created Cloud Security Service profile. Primary Point-of-Presence *:Â Here, insert the IP address of the on-ramp primary POP. Alternatively, the FQDN can be also inserted. Note that inserting the FQDN will avoid the reconfiguration on the VeloCloud side if the FortiSASE Branch-On-Ramp PoP IP is modified. Secondary Point-of-Presence:Â Here, insert the IP address of the on-ramp secondary POP. Alternatively, the FQDN can be also inserted. Note that inserting the FQDN will avoid the reconfiguration on the VeloCloud side if the FortiSASE Branch-On-Ramp PoP IP is modified.
Now, go on the desired EDGE and customize and deploy the Cloud Security Service previously created:
Cloud Security Service: The name of the Cloud Security Service defined in the previous steps. Hash: Select the same value defined in FortiSASE Branch-On-Ramp IPsec Tunnel -SHA 256 that maps the SHA256 on FortiSASE. Encryption: Select the same value defined in FortiSASE Branch-On-Ramp IPsec Tunnel -AES 256 CBC that maps the AES256 on FortiSASE. Key Exchange Protocol: Select IKEv2.
In the credentials setting, insert the following by selecting ADD:
Associate the Cloud Security Service with the Business Policy to steer the traffic over the newly created IPsec tunnel towards FortiSASE.
Verify tunnel status and traffic statistics on FortiSASE.
In the FortiSASE GUI, go to Operation -> On-ramp tunnel and select Connections, then check if the connection is active and Incoming and Outgoing bytes are incrementing:
The Phase1 status/ Status / Phase-2 selector should be green.
|
