Where can I view the complete configuration generated by the IPSec wizard? (defaults?)

Forum|Forum|7 years ago
October 25, 2018
2 replies
32342 views

I'm used to configuring IPSec tunnels manually, and specifying encapsulation, hash, etc. I have Fortigate 30e firewalls, and whenever you select "Create new" under "IPSec tunnels" it takes you to the Wizard. This is fine, but if I want to use an undocumented client on Linux such as Openswan or Shrewsoft, I can't find the detailed phase 1 and phase 2 configs. It appears that some configuration details are "baked in" and not displayed when you dump the configuration.

Is there some documentation as to what is used for all IPSec config attributes? For example, DES, 3DES, etc.

Thanks

Best answer by tanr

The documentation covers a lots of it: http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-ipsecvpn/IntroVPN.htm, including some of the CLI settings.

To see more of the possible settings in the GUI, you need to convert a wizard created tunnel to a custom tunnel. This is hidden in the docs - see the beginning of http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-ipsecvpn/Phase_2/Config_Phase2_Parameters.htm.

To see more details than that you'll need to go to the CLI section for vpn ipsec, for example:

config vpn ipsec phase1-interface

config vpn ipsec phase2-interface

See the CLI admin guide for more details on the CLI elements:

http://help.fortinet.com/cli/fos50hlp/56/index.htm

https://docs.fortinet.com/d/fortigate-fortios-5.6.6-cli-reference

Remember that in the CLI you need to "show full" to see all options, and that some won't show up unless/until you set various modes for the object you're looking at, though "tree" will show everything.

There are also a number of cookbook articles on IPSec VPN.

tanrAnswer

New Member

The documentation covers a lots of it: http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-ipsecvpn/IntroVPN.htm, including some of the CLI settings.

To see more of the possible settings in the GUI, you need to convert a wizard created tunnel to a custom tunnel. This is hidden in the docs - see the beginning of http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-ipsecvpn/Phase_2/Config_Phase2_Parameters.htm.

To see more details than that you'll need to go to the CLI section for vpn ipsec, for example:

config vpn ipsec phase1-interface

config vpn ipsec phase2-interface

See the CLI admin guide for more details on the CLI elements:

http://help.fortinet.com/cli/fos50hlp/56/index.htm

https://docs.fortinet.com/d/fortigate-fortios-5.6.6-cli-reference

Remember that in the CLI you need to "show full" to see all options, and that some won't show up unless/until you set various modes for the object you're looking at, though "tree" will show everything.

There are also a number of cookbook articles on IPSec VPN.

rbrossAuthor

Visitor III

The "convert to a custom tunnel" is exactly what I needed, thanks. I've configured all sorts of IPSec firewalls manually with clients, so I needed control (and views) of both sides. I was attempting to guess the phase 1 SA settings.

Sign up

Login with SSO

Login to the community

Login with SSO