Description
This article describes IPSec Configuration in HA environment.
Scope
For version 6.4.3.
Solution
This is a sample configuration of site-to-site IPsec VPN in an HA environment.
For this example, set up HA as described in the HA topics.
When setting up HA, enable the following options to ensure IPsec VPN traffic is not interrupted during an HA failover:
1) session-pickup under HA settings.
2) ha-sync-esp-seqno under IPsec phase1-interface settings.
This article describes IPSec Configuration in HA environment.
Scope
For version 6.4.3.
Solution
This is a sample configuration of site-to-site IPsec VPN in an HA environment.
For this example, set up HA as described in the HA topics.
When setting up HA, enable the following options to ensure IPsec VPN traffic is not interrupted during an HA failover:
1) session-pickup under HA settings.
2) ha-sync-esp-seqno under IPsec phase1-interface settings.
Configure IPsec VPN in an HA environment using the GUI or CLI.
In this example, the VPN name for HQ1 is "to_HQ2", and the VPN name for HQ2 is "to_HQ1".
To configure IPsec VPN in an HA environment in the GUI:
1) Set up IPsec VPN on HQ1 (the HA cluster):
Go to VPN -> IPsec Wizard and configure the following settings for VPN Setup:
- Enter a VPN name.
- For Template Type, select 'Site to Site'.
- For 'Remote Device Type', select 'FortiGate'.
- For 'NAT Configuration', set 'No NAT between sites'.
- Select 'Next'.
Configure the following settings for Authentication:
- For 'Remote Device', select 'IP Address'.
- In the 'IP address' field, enter '172.16.202.1'.
- For 'Outgoing Interface', select 'port1'.
- For 'Authentication Method', select 'Pre-shared Key'.
- In the 'Pre-shared Key' field, enter an example key.
- Select 'Next'.
Configure the following settings for Policy & Routing:
- From the 'Local Interface dropdown' menu, select the 'local interface'.
- Configure the 'Local Subnets' as '10.1.100.0/24'.
- Configure 'the Remote Subnets' as '172.16.101.0/24'.
- Select 'Create'.
2) Set up IPsec VPN on HQ2:
Go to VPN- > IPsec Wizard and configure the following settings for VPN Setup:
- Enter a VPN name.
- For 'Template Type', select 'Site to Site'.
- For 'Remote Device Type', select 'FortiGate'.
- For 'NAT Configuration', set 'No NAT between sites'.
- Select 'Next'.
Configure the following settings for Authentication:
- For 'Remote Device', select 'IP Address'.
- In the 'IP address' field, enter '172.16.200.1'.
- For 'Outgoing Interface', select 'port13'.
- For 'Authentication Method', select 'Pre-shared Key'.
- In the 'Pre-shared Key' field, enter an example key.
- Select 'Next'.
Configure the following settings for Policy & Routing:
- From the 'Local Interface dropdown' menu, select the desired local interface. In this example, it is 'port9'.
- Configure the 'Local Subnets' as '172.16.101.0'.
- Configure the 'Remote Subnets' as '10.1.100.0'.
- Select 'Create.
To configure IPsec VPN in an HA environment using the CLI:
1) Configure HA. In this example, two FortiGates work in active-passive mode. The HA heartbeat interfaces are WAN1 and WAN2:
- Configure HQ1:
- Configure HQ1:
- Configure HQ1:
- Configure HQ1:
- Configure HQ1:
- Configure HQ1:
In this example, the VPN name for HQ1 is "to_HQ2", and the VPN name for HQ2 is "to_HQ1".
To configure IPsec VPN in an HA environment in the GUI:
1) Set up IPsec VPN on HQ1 (the HA cluster):
Go to VPN -> IPsec Wizard and configure the following settings for VPN Setup:
- Enter a VPN name.
- For Template Type, select 'Site to Site'.
- For 'Remote Device Type', select 'FortiGate'.
- For 'NAT Configuration', set 'No NAT between sites'.
- Select 'Next'.
Configure the following settings for Authentication:
- For 'Remote Device', select 'IP Address'.
- In the 'IP address' field, enter '172.16.202.1'.
- For 'Outgoing Interface', select 'port1'.
- For 'Authentication Method', select 'Pre-shared Key'.
- In the 'Pre-shared Key' field, enter an example key.
- Select 'Next'.
Configure the following settings for Policy & Routing:
- From the 'Local Interface dropdown' menu, select the 'local interface'.
- Configure the 'Local Subnets' as '10.1.100.0/24'.
- Configure 'the Remote Subnets' as '172.16.101.0/24'.
- Select 'Create'.
2) Set up IPsec VPN on HQ2:
Go to VPN- > IPsec Wizard and configure the following settings for VPN Setup:
- Enter a VPN name.
- For 'Template Type', select 'Site to Site'.
- For 'Remote Device Type', select 'FortiGate'.
- For 'NAT Configuration', set 'No NAT between sites'.
- Select 'Next'.
Configure the following settings for Authentication:
- For 'Remote Device', select 'IP Address'.
- In the 'IP address' field, enter '172.16.200.1'.
- For 'Outgoing Interface', select 'port13'.
- For 'Authentication Method', select 'Pre-shared Key'.
- In the 'Pre-shared Key' field, enter an example key.
- Select 'Next'.
Configure the following settings for Policy & Routing:
- From the 'Local Interface dropdown' menu, select the desired local interface. In this example, it is 'port9'.
- Configure the 'Local Subnets' as '172.16.101.0'.
- Configure the 'Remote Subnets' as '10.1.100.0'.
- Select 'Create.
To configure IPsec VPN in an HA environment using the CLI:
1) Configure HA. In this example, two FortiGates work in active-passive mode. The HA heartbeat interfaces are WAN1 and WAN2:
# config system ha2) Configure the WAN interface and default route. The WAN interface is the interface connected to the ISP. It can work in static mode (as shown in this example), DHCP, or PPPoE mode. The IPsec tunnel is established over the WAN interface.
set group-name "FGT-HA"
set mode a-p
set password sample
set hbdev "wan1" 50 "wan2" 50
set session-pickup enable
set priority 200
set override-wait-time 10
end
- Configure HQ1:
# config system interface- Configure HQ2:
edit "port1"
set vdom "root"
set ip 172.16.200.1 255.255.255.0
next
end
# config router static
edit 1
set gateway 172.16.200.3
set device "port1"
next
end
# config system interface3) Configure the internal (protected subnet) interface. The internal interface connects to the corporate internal network. Traffic from this interface routes out the IPsec VPN tunnel.
edit "port25"
set vdom "root"
set ip 172.16.202.1 255.255.255.0
next
end
# config router static
edit 1
set gateway 172.16.202.2
set device "port25"
next
end
- Configure HQ1:
# config system interface- Configure HQ2:
edit "dmz"
set vdom "root"
set ip 10.1.100.1 255.255.255.0
next
end
# config system interface4) Configure the IPsec phase1-interface. This example uses PSK as the authentication method. You can also use signature authentication.
edit "port9"
set vdom "root"
set ip 172.16.101.1 255.255.255.0
next
end
- Configure HQ1:
# config vpn ipsec phase1-interface- Configure HQ2:
edit "to_HQ2"
set interface "port1"
set peertype any
set net-device enable
set ha-sync-esp-seqno enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set remote-gw 172.16.202.1
set psksecret sample
next
end
# config vpn ipsec phase1-interface5) Configure the IPsec phase2-interface:
edit "to_HQ1"
set interface "port25"
set peertype any
set net-device enable
set ha-sync-esp-seqno enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set remote-gw 172.16.200.1
set psksecret sample
next
end
- Configure HQ1:
# config vpn ipsec phase2-interface- Configure HQ2:
edit "to_HQ2"
set phase1name "to_HQ2"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
end
# config vpn ipsec phase2-interface6) Configure static routes. Two static routes are added to reach the remote protected subnet. The blackhole route is important to ensure IPsec traffic does not match the default route when the IPsec tunnel is down.
edit "to_HQ1"
set phase1name "to_HQ1"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
end
- Configure HQ1:
# config router static- Configure HQ2:
edit 2
set dst 172.16.101.0 255.255.255.0
set device "to_HQ2"
next
edit 3
set dst 172.16.101.0 255.255.255.0
set blackhole enable
set distance 254
next
end
# config router static7) Configure two firewall policies to allow bi-directional IPsec traffic flow over the IPsec tunnel:
edit 2
set dst 10.1.100.0 255.255.255.0
set device "to_HQ1"
next
edit 3
set dst 10.1.100.0 255.255.255.0
set blackhole enable
set distance 254
next
end
- Configure HQ1:
# config firewall policy- Configure HQ2:
edit 1
set name "inbound"
set srcintf "to_HQ2"
set dstintf "dmz"
set srcaddr "172.16.101.0"
set dstaddr "10.1.100.0"
set action accept
set schedule "always"
set service "ALL"
next
edit 2
set name "outbound"
set srcintf "dmz"
set dstintf "to_HQ2"
set srcaddr "10.1.100.0"
set dstaddr "172.16.101.0"
set action accept
set schedule "always"
set service "ALL"
next
end
# config firewall policy8) Use the following diagnose commands to check IPsec phase1/phase2 interface status including the sequence number on the secondary FortiGate.
edit 1
set name "inbound"
set srcintf "to_HQ1"
set dstintf "port9"
set srcaddr "10.1.1.00.0"
set dstaddr "172.16.101.0"
set action accept
set schedule "always"
set service "ALL"
next
edit 2
set name "outbound"
set srcintf "port9"
set dstintf "to_HQ1"
set srcaddr "172.16.101.0"
set dstaddr "10.1.100.0"
set action accept
set schedule "always"
set service "ALL"
next
end
The diagnose debug application ike -1 command is the key to troubleshoot why the IPsec tunnel failed to establish.
- Run the HQ1 # diagnose vpn ike gateway list command. The system should return the following:
- Run the HQ1-second # diagnose vpn tunnel list command. The system should return the following:
- Run the HQ1 # diagnose vpn ike gateway list command. The system should return the following:
vd: root/0- Run the HQ1 # diagnose vpn tunnel list command. The system should return the following:
name: to_HQ2
version: 1
interface: port1 11
addr: 172.16.200.1:500 -> 172.16.202.1:500
created: 5s ago
IKE SA: created 1/1 established 1/1 time 0/0/0 ms
IPsec SA: created 2/2 established 2/2 time 0/0/0 ms
id/spi: 12 6e8d0532e7fe8d84/3694ac323138a024 direction: responder status: established 5-5s ago = 0ms proposal: aes128-sha256 key: b3efb46d0d385aff-7bb9ee241362ee8d lifetime/rekey: 86400/86124 DPD sent/recv: 00000000/00000000
list all ipsec tunnel in vd 0- Run the HQ1 # execute ha manage 0 admin command.
name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0
bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=0 refcnt=11 ilast=7 olast=87 ad=/0
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate
src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=42927/0B replaywin=2048
seqno=1 esn=0 replaywin_lastseq=00000000 itn=0
life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7
ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b
enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a
ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3
dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
ESP seqno synced to primary FortiGate every five minutes, and big gap between primary and secondary to ensure that no packet is dropped after HA failover caused by tcp-replay. Check ESP sequence number synced on secondary FortiGate.
- Run the HQ1-second # diagnose vpn tunnel list command. The system should return the following:
list all ipsec tunnel in vd 0
name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0
bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=0 refcnt=11 ilast=13 olast=274 ad=/0
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate
src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=27 type=00 soft=0 mtu=1280 expire=42740/0B replaywin=2048
seqno=47868c01 esn=0 replaywin_lastseq=00000000 itn=0
life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7
ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b
enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a
ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3
dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
