Technical Tip: IPsec VPN in HA Environment

[jvaishnav]

Description

This article describes IPsec Configuration in HA environment.

Scope

For version 6.4.3.

Solution

This is a sample configuration of site-to-site IPsec VPN in an HA environment.
For this example, set up HA as described in the HA topics.
When setting up HA, enable the following options to ensure IPsec VPN traffic is not interrupted during an HA failover:

1. session-pickup under HA settings.
2. ha-sync-esp-seqno under IPsec phase1-interface settings.

Configure IPsec VPN in an HA environment using the GUI or CLI.
In this example, the VPN name for HQ1 is 'to_HQ2', and the VPN name for HQ2 is 'to_HQ1'.
To configure IPsec VPN in an HA environment in the GUI:

1. Set up IPsec VPN on HQ1 (the HA cluster):

Go to VPN -> IPsec Wizard and configure the following settings for VPN Setup:

• Enter a VPN name.
• For Template Type, select 'Site to Site'.
• For 'Remote Device Type', select 'FortiGate'.
• For 'NAT Configuration', set 'No NAT between sites'.
• Select 'Next'.
  

Configure the following settings for Authentication:

• For 'Remote Device', select 'IP Address'.
• In the 'IP address' field, enter '172.16.202.1'.
• For 'Outgoing Interface', select 'port1'.
• For 'Authentication Method', select 'Pre-shared Key'.
• In the 'Pre-shared Key' field, enter an example key.
• Select 'Next'.
  
  

Configure the following settings for Policy & Routing:

• From the 'Local Interface dropdown' menu, select the 'local interface'.
• Configure the 'Local Subnets' as '10.1.100.0/24'.
• Configure 'the Remote Subnets' as '172.16.101.0/24'.
• Select 'Create'.
  

2. Set up IPsec VPN on HQ2:

Go to VPN -> IPsec Wizard and configure the following settings for VPN Setup:

• Enter a VPN name.
• For 'Template Type', select 'Site to Site'.
• For 'Remote Device Type', select 'FortiGate'.
• For 'NAT Configuration', set 'No NAT between sites'.
• Select 'Next'.
  
  

Configure the following settings for Authentication:

• For 'Remote Device', select 'IP Address'.
• In the 'IP address' field, enter '172.16.200.1'.
• For 'Outgoing Interface', select 'port13'.
• For 'Authentication Method', select 'Pre-shared Key'.
• In the 'Pre-shared Key' field, enter an example key.
• Select 'Next'.
  

Configure the following settings for Policy & Routing:

• From the 'Local Interface dropdown' menu, select the desired local interface. In this example, it is 'port9'.
• Configure the 'Local Subnets' as '172.16.101.0'.
• Configure the 'Remote Subnets' as '10.1.100.0'.
• Select 'Create'.
  

To configure IPsec VPN in an HA environment using the CLI:

1. Configure HA. In this example, two FortiGates work in active-passive mode. The HA heartbeat interfaces are WAN1 and WAN2:

config system ha
    set group-name "FGT-HA"
    set mode a-p
    set password sample
    set hbdev "wan1" 50 "wan2" 50
    set session-pickup enable
    set priority 200
    set override-wait-time 10
end

2. Configure the WAN interface and default route. The WAN interface is the interface connected to the ISP. It can work in static mode (as shown in this example), DHCP, or PPPoE mode. The IPsec tunnel is established over the WAN interface.

Configure HQ1:

config system interface
    edit "port1"
        set vdom "root"
        set ip 172.16.200.1 255.255.255.0
    next
end
config router static
    edit 1
        set gateway 172.16.200.3
        set device "port1"
    next
end

• Configure HQ2:
  

config system interface
    edit "port25"
        set vdom "root"
        set ip 172.16.202.1 255.255.255.0
    next
end
config router static
    edit 1
        set gateway 172.16.202.2
        set device "port25"
    next
end

3. Configure the internal (protected subnet) interface. The internal interface connects to the corporate internal network. Traffic from this interface routes out the IPsec VPN tunnel.

• Configure HQ1:
  

config system interface
    edit "dmz"
        set vdom "root"
        set ip 10.1.100.1 255.255.255.0
    next
end

• Configure HQ2:
  

config system interface
    edit "port9"
        set vdom "root"
        set ip 172.16.101.1 255.255.255.0
    next
end

4. Configure the IPsec phase1-interface. This example uses PSK as the authentication method. Signature authentication can also be used.

• Configure HQ1:
  

config vpn ipsec phase1-interface
    edit "to_HQ2"
        set interface "port1"
        set peertype any
        set net-device enable
        set ha-sync-esp-seqno enable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set remote-gw 172.16.202.1
        set psksecret sample
    next
end

• Configure HQ2:
  

config vpn ipsec phase1-interface
    edit "to_HQ1"
        set interface "port25"
        set peertype any
        set net-device enable
        set ha-sync-esp-seqno enable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set remote-gw 172.16.200.1
        set psksecret sample
    next
end

5. Configure the IPsec phase2-interface:

• Configure HQ1:
  

config vpn ipsec phase2-interface
    edit "to_HQ2"
        set phase1name "to_HQ2"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set auto-negotiate enable
    next
end

• Configure HQ2:
  

config vpn ipsec phase2-interface
    edit "to_HQ1"
        set phase1name "to_HQ1"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set auto-negotiate enable
    next
end

6. Configure static routes. Two static routes are added to reach the remote-protected subnet. The blackhole route is important to ensure IPsec traffic does not match the default route when the IPsec tunnel is down.

• Configure HQ1:
  

config router static
    edit 2
        set dst 172.16.101.0 255.255.255.0
        set device "to_HQ2"
    next
    edit 3
        set dst 172.16.101.0 255.255.255.0
        set blackhole enable
        set distance 254
    next
end

• Configure HQ2:
  

config router static
    edit 2
        set dst 10.1.100.0 255.255.255.0
        set device "to_HQ1"
    next
    edit 3
        set dst 10.1.100.0 255.255.255.0
        set blackhole enable
        set distance 254
    next
end

7. Configure two firewall policies to allow bi-directional IPsec traffic flow over the IPsec tunnel:

• Configure HQ1:
  

config firewall policy
    edit 1
        set name "inbound"
        set srcintf "to_HQ2"
        set dstintf "dmz"
        set srcaddr "172.16.101.0"
        set dstaddr "10.1.100.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set name "outbound"
        set srcintf "dmz"
        set dstintf "to_HQ2"
        set srcaddr "10.1.100.0"
        set dstaddr "172.16.101.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

• Configure HQ2:
  

config firewall policy
    edit 1
        set name "inbound"
        set srcintf "to_HQ1"
        set dstintf "port9"
        set srcaddr "10.1.1.00.0"
        set dstaddr "172.16.101.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set name "outbound"
        set srcintf "port9"
        set dstintf "to_HQ1"
        set srcaddr "172.16.101.0"
        set dstaddr "10.1.100.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

8. Use the following diagnose commands to check IPsec phase1/phase2 interface status including the sequence number on the secondary FortiGate.

   The diagnose debug application ike -1 command is the key to troubleshoot why the IPsec tunnel failed to establish.

• Run the HQ1 diagnose vpn ike gateway list command. The system should return the following:
  

vd: root/0
name: to_HQ2
version: 1
interface: port1 11
addr: 172.16.200.1:500 -> 172.16.202.1:500
created: 5s ago
IKE SA: created 1/1 established 1/1 time 0/0/0 ms
IPsec SA: created 2/2 established 2/2 time 0/0/0 ms
id/spi: 12 6e8d0532e7fe8d84/3694ac323138a024 direction: responder status: established 5-5s ago = 0ms proposal: aes128-sha256 key: b3efb46d0d385aff-7bb9ee241362ee8d lifetime/rekey: 86400/86124 DPD sent/recv: 00000000/00000000-

Run the HQ1 diagnose vpn tunnel list command. The system should return the following:

list all ipsec tunnel in vd 0
 
name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0
bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=0 refcnt=11 ilast=7 olast=87 ad=/0
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate
src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=42927/0B replaywin=2048
seqno=1 esn=0 replaywin_lastseq=00000000 itn=0
life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7
ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b
enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a
ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3
dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
ESP seqno synced to primary FortiGate every five minutes, and big gap between primary and secondary to ensure that no packet is dropped after HA failover caused by tcp-replay. Check ESP sequence number synced on secondary FortiGate.

• Run the HQ1 execute ha manage 0 admin command.
  
  
• Run the HQ1-second diagnose vpn tunnel list command. The system should return the following:

list all ipsec tunnel in vd 0
 
name=to_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0
bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/528 options[0210]=create_dev frag-rfc accept_traffic=1
proxyid_num=1 child_num=0 refcnt=11 ilast=13 olast=274 ad=/0
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=to_HQ2 proto=0 sa=1 ref=2 serial=1 auto-negotiate
src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=27 type=00 soft=0 mtu=1280 expire=42740/0B replaywin=2048
seqno=47868c01 esn=0 replaywin_lastseq=00000000 itn=0
life: type=01 bytes=0/0 timeout=42930/43200 dec: spi=ef9ca700 esp=aes key=16 a2c6584bf654d4f956497b3436f1cfc7
ah=sha1 key=20 82c5e734bce81e6f18418328e2a11aeb7baa021b
enc: spi=791e898e esp=aes key=16 0dbb4588ba2665c6962491e85a4a8d5a
ah=sha1 key=20 2054b318d2568a8b12119120f20ecac97ab730b3
dec:pkts/bytes=0/0, enc:pkts/bytes=0/0

IKE debug: [Master]

ike 0:p1:0: established IKE SA a0cf08f3d3a7f0b8/6e6d8812674bc38d
ike 0:p1: HA send IKE connection add 198.51.100.1->203.0.113.1
ike 0:p1:0: HA send IKE SA add a0cf08f3d3a7f0b8/6e6d8812674bc38d

hasync debug: [Master]

recv data from iked: size=968, hdr_len=24, type=1
recv IPSEC_HA_SYNC_NORMAL, sent to all peers

hasync debug: [Slave]

conn=0x60519b0, recv all 976 bytes data. no file data to recv
conn=0x60519b0 added to list of sync_type=4(ipsec)
[ha_ipsec_stream_handler] recving tcp packet: from=169.254.0.2, len=968
968/968 bytes are forwarded to iked

IKE debug: [Slave]

ike 0:p1: HA add new connection 198.51.100.1->203.0.113.1
ike 0:p1: HA add IKE SA a0cf08f3d3a7f0b8/6e6d8812674bc38d
ike 0:p1:0: HA add IKE SA done