Technical Tip: Asymmetric pre-shared key with IKEv2

[MJ_FTNT]

Description	This article describes Asymmetric Pre-Shared Key (PSK) authentication within the context of Internet Key Exchange version 2 (IKEv2) Virtual Private Networks (VPNs) on FortiGate.
Scope	FortiGate.
Solution	In contrast to some other third-party VPN devices like the Cisco ASA, which often require the mandatory specification of both a local and remote pre-shared key, the FortiGate VPN solution offers a more advanced and flexible approach. While FortiGate does provide the option to configure conventional symmetric pre-shared keys for authentication, it also supports asymmetric pre-shared keys. Below is a screenshot of the Cisco ASA VPN Wizard, which asks for local and remote PSK while configuring a VPN. On the FortiGate for IKEv2 VPN tunnels, it is possible to achieve asymmetric PSK by using the below commands (this is not available in the GUI): config vpn ipsec phase1-interface     edit <VPN_Name>         set ike-version 2         set authmethod psk         set authmethod-remote psk         set psksecret <local-password>         set psksecret-remote <remote-password>     next end Here, FortiGate's VPN local PSK will be the remote PSK for Cisco ASA and Cisco ASA's local PSK will be the remote PSK for FortiGate.