Description
This article describes how to set up an IPsec VPN between a FortiGate and a Cisco router.
Scope
FortiGate.
Solution
Prerequisites:
- FortiGate (with basic configuration).
- Cisco router (with basic configuration).
- Internet connection on both ends.
Network Topology Overview:
Diagram showing the topology: FortiGate and Cisco router on different ends, connected via the internet with specific internal subnets behind them.
Configuration on HO side (FortiGate):
config vpn ipsec phase1-interface
edit "HO_Side"
set type static
set remote-gw 192.168.4.1
set authmethod psk
set psksecret "salon123"
set dhgrp 5
set peertype any
set proposal aes256-sha1
set interface wan
set nattraversal disable
set keylife 86400
next
end
config vpn ipsec phase2-interface
edit "HO_Phase2"
set phase1name "HO_Side"
set pfs enable
set dhgrp 5
set keylife-type seconds
set keylifeseconds 86400
set proposal aes256-sha1
set src-subnet 192.168.1.0/24
set dst-subnet 192.168.2.0/24
next
Note:
- Required firewall policy and route need to be configured on the FortiGate Side.
- For more than one subnet under Phase 2 (both local and remote), it is recommended to configure each of them on a separate Phase 2: Technical Tip: IPsec VPN between FortiGate and other Vendor with multiple subnets
BranchOffice Router (Cisco):
#conf t
#ip route 192.168.1.0 255.255.255.0 192.168.4.2
#ip route 192.168.3.0 255.255.255.0 192.168.4.2
#access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
#crypto isakmp policy 1
#encr aes
#authentication pre-share
#group 5
#exit
#conf t
#crypto isakmp key salon123 address 192.168.3.1
#exit
#conf t
#crypto ipsec transform-set VPN-TS esp-aes 256 esp-sha-hmac
#crypto map VPN-MAP 10 ipsec-isakmp
#set peer 192.168.3.1
#set pfs group5
#set security-association lifetime seconds 86400
#set transform-set VPN-TS
#match address 100
#interface GigabitEthernet0/0/0
#ip address 192.168.2.1 255.255.255.0
#no shutdown
#interface GigabitEthernet0/0/1(outgoing interface)
#ip address 192.168.4.1 255.255.255.0
#no shutdown
#crypto map VPN-MAP
