FortSASE - BGP Router ID Subnet

Hello Ajay,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

Hi Ajay,

To bring up a dial-up VPN tunnel between FortiSASE PoPs and a FortiGate SPA Hub, 

1. Configure FortiGate as IPsec Server (Hub): Set up the FortiGate in your data center as the IPsec server.  Enable BGP on the FortiGate. Configure ADVPN in sender mode.  Enable mode-cfg. Assign a unique network-id to each Hub.
2. Configure FortiSASE as Dial-up Client (Spoke): Access the FortiSASE console. Navigate to Network -> Secure Private Access. - Select the 'Network Configuration' tab. - Define common parameters for the connection to the on-prem FortiGate devices.
3. Psec VPN Settings: Use IKEv2 for the VPN. Enable mode config to allow FortiSASE PoPs to acquire IP addresses dynamically. Set up BGP peering using the acquired IP addresses. - Establish one overlay tunnel per underlay, even if multiple WAN underlays exist. - Use network overlay IDs for each tunnel by configuring `set network-overlay enable` and `set network-id <n>`. Configure a preshared key for each overlay tunnel. 
4. Phase 1 and Phase 2 Proposals:For Phase 1, use proposals like aes128-sha256, aes256-sha256, aes128-sha1, aes256-sha1, with DH groups 14 and 5
5. For Phase 2, use proposals like aes128-sha1, aes256-sha1, aes128-sha256, aes256-sha256, aes128gcm, aes256gcm, chacha20poly1305, with DH groups 14 and 5.
6. Enable ADVPN on Hub: Configure the hub with `set auto-discovery-sender enable` to enable ADVPN.