Technical Tip: Configuring IPSec tunnel between FortiGate and Palo Alto

[epinheiro]

Description	This article is a sample configuration of IPsec VPN authenticating a remote Palo Alto peer with a pre-shared key. Topology:
Scope	FortiGate, Palo Alto.
Solution	Go to: VPN -> IPSec Tunnels, select 'Create New '-> IPSec Tunnel. Note: The wizard shows all available options so that it is possible to speed up the process, but the Custom' option will be used for a better understanding of each step for the IPSec tunnel creation: Set the tunnel name (After creation, the tunnel name cannot be modified). The process is straightforward. Using only one screen, it will be possible to configure Phase 1 and Phase 2. Note: This is just a sample and it is necessary to adjust the tunnel configuration according to the requirements of the network. Phase I Configuration:  Phase II Configuration: Checking the tunnel: Create the static route pointing to the Palo Alto LAN: Create the firewall policy allowing outbound and inbound traffic: Note: All parameters are configured on FortiGate, it is also necessary to configure on the Palo Alto firewall for Phase 1 and Phase 2. On Palo Alto, it is necessary to access more options on different screens to create the IPSec tunnel. For Phase 1 Proposal, access 'IPSec Crypto': For Phase 2 Proposal, access 'IKE Crypto': Then, configure the IKE gateway: On 'Advanced Options', set the Phase 2 Proposal on 'Ike Crypto Profile': Create a tunnel interface on the following path: Network -> Interfaces -> Tunnel. It is necessary to set an ID for the tunnel. Then create the IPSec tunnel on the following path: Network -> IPSec tunnel. It is necessary to select the tunnel interface with the ID  just created, in this case, 'tunnel.1'. Also, select the Phase 1 Proposal on 'IPSec Crypto Profile': Set the phase 2 selectors on 'Proxy IDs': Create the static route pointing to the FortiGate LAN on Network -> Virtual Router -> Default -> Static Route. Create the Security Policy allowing outbound and inbound traffic on Policies -> Security. Validating the IPSec tunnel on FortiGate: Validating the IPSec tunnel on Palo Alto: Ping Test: On the FortiGate, to check the 'IPSec Monitor', go to Dashboard -> Network -> IPSec.