IPSec VPN - not creating tunnel IP address in GNS3

Forum|Forum|5 years ago
January 28, 2021
3 replies
6267 views

Hi,

I have inquiry if do i need to manually input ip address on IPSec tunnel interface after establishing the IPSEC VPN thru fortigate?

Or it is automatically created?

Attached is the topology in GNS3.

IPSecDesign.JPG

Toshi_Esumi

SuperUser

In case of site-to-site VPNs, you need to manually configure a tunnel IP address on the tunnel interface if you want to use it for routing/protocol, etc. on both sides. Even if you create it via GUI wizard, it doesn't set the IP on the tunnel interface so you need to configure it afterword. The tunnel interface is the same as the phase1 name.

posemmanAuthor

New Member

Both fortigate is now connected thru ipsec even w/o tunnel ip address.

Do I still need to set ip address on tunnel interface?

Scenario is, we have MPLS as a main connection on both offices and this connection use EIGRP routing protocol.

What we need is to create IPSEC VPN as a backup connection when MPLS is down.

What I do in this simulation is I create OSPF on core switch and Fortigate then redistribute EIGRP subnets on OSPF process.

Core switch config:

router ospf 1

router-id 2.2.2.2

log-adjacency-changes

redistribute eigrp 27 subnets

network 172.27.252.0 0.0.0.255 area 0

router eigrp 27

network 172.27.252.0 0.0.0.255

network 172.27.253.0 0.0.0.255

network 172.27.7.0 0.0.0.255

no auto-summary

Is the redistribution of routing to fortigate is correct?

SiteTOSite.JPG

Toshi_Esumi

SuperUser

You don't have to if you don't need. That's why the wizard doesn't ask you to set the tunnel IP.

If you have multiple point-to-point neighboring and want to manipulate path per traffic it's easier to debug/troubleshoot when each tunnel interface has unique IP.

Sign up

Login with SSO

Login to the community

Login with SSO