FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
aamin
Staff
Staff

Description

 

This article describes how to connect Ubuntu PC to FortiGate via IPsec dialup connection.

 

Scope

 

Forticlient Linux version does not support Dialup IPsec, In this case, IPsec connection can be configured using strongswan package on Linux.

 

The below reference document shows the configuration on Ubuntu 20.04

 

Solution

 

Configuration on Fortigate:

 

To configure VPN on FortiGate, go to GUI IPsec Wizard -> Template Type: Remote Access -> Remote Device Type: Client-Based, Cisco.

 

aamin_0-1647672831225.png

 

Select the incoming interface, Preshared key, and User group.

 

aamin_1-1647673476227.png

 

Select the appropriate LAN interface, Subnet, and IP range for VPN.

 

aamin_2-1647673684565.png

 

Forticlient Linux does not support IPsec Dialup connection at the moment.

 

To connect VPN from Ubuntu using IPsec Protocol a native VPN package 'strongswan' can be installed.

 

Configuration on Ubuntu 20.04:

 

Install Strongswan on Ubuntu using apt package manager.

 

$ sudo apt install strongswan

 

Also, install the below package.

 

$ sudo apt install charon-systemd

 

To Enable the kernel to do packet forwarding edit the /etc/sysctl.conf and uncomment the below lines.

 

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

 

To check the status of strongswan service run the below command.

 

# systemctl status strongswan.service

 

The below message will appear if the process is running.

 

● strongswan.service - strongSwan IPsec IKEv1/IKEv2 daemon using swanctl
Loaded: loaded (/lib/systemd/system/strongswan.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2022-03-19 08:19:10 CET; 46s ago
Process: 6903 ExecStartPost=/usr/sbin/swanctl --load-all --noprompt (code=exited, status=0/SUCCESS)
Main PID: 6886 (charon-systemd)
Status: "charon-systemd running, strongSwan 5.8.2, Linux 5.4.0-104-generic, x86_64"
Tasks: 17 (limit: 2268)
Memory: 2.5M
CGroup: /system.slice/strongswan.service
└─6886 /usr/sbin/charon-systemd

Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: loaded IKE secret for 10.5.21.252
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: loaded EAP secret for ubuntu_VPN
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: loaded plugins: charon-systemd aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 p>
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: dropped capabilities, running as uid 0, gid 0
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: spawning 16 worker threads
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no files found matching '/etc/swanctl/conf.d/*.conf'
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no authorities found, 0 unloaded
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no pools found, 0 unloaded
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no connections found, 0 unloaded
Mar 19 08:19:10 xenon-kvm33 systemd[1]: Started strongSwan IPsec IKEv1/IKEv2 daemon using swanctl.
...skipping...
● strongswan.service - strongSwan IPsec IKEv1/IKEv2 daemon using swanctl
Loaded: loaded (/lib/systemd/system/strongswan.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2022-03-19 08:19:10 CET; 46s ago
Process: 6903 ExecStartPost=/usr/sbin/swanctl --load-all --noprompt (code=exited, status=0/SUCCESS)
Main PID: 6886 (charon-systemd)
Status: "charon-systemd running, strongSwan 5.8.2, Linux 5.4.0-104-generic, x86_64"
Tasks: 17 (limit: 2268)
Memory: 2.5M
CGroup: /system.slice/strongswan.service
└─6886 /usr/sbin/charon-systemd

Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: loaded IKE secret for 10.5.21.252
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: loaded EAP secret for ubuntu_VPN
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: loaded plugins: charon-systemd aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 p>
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: dropped capabilities, running as uid 0, gid 0
Mar 19 08:19:10 xenon-kvm33 charon-systemd[6886]: spawning 16 worker threads
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no files found matching '/etc/swanctl/conf.d/*.conf'
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no authorities found, 0 unloaded
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no pools found, 0 unloaded
Mar 19 08:19:10 xenon-kvm33 swanctl[6903]: no connections found, 0 unloaded
Mar 19 08:19:10 xenon-kvm33 systemd[1]: Started strongSwan IPsec IKEv1/IKEv2 daemon using swanctl.

Further strongswan has two files that can be edited to configure VPN.

 

In this case, we have to configure the below settings:

 

Fortigate Gateway IP: 10.5.21.252

Tunnel Type Ikev1 Main Mode

Fortigate LAN IP: 10.140.0.0/20

Authentication Type: Preshared Key & Xauth

Preshared Key: abcd1234

Xauth Username: ubuntu_VPN

Xauth Password: ubuntu

 

The first file that has to be edited is /etc/ipsec.conf.

 

It can be edited via vi text editor, Paste the below lines for the connection.

 

conn "FGT"                                                                                   
keyexchange=ikev1
ikelifetime=1440m
keylife=60m
aggressive=no
ike=aes256-sha256-modp1024
esp=aes256-sha256
xauth=client
left=%defaultroute
leftsourceip=%config
leftauth=psk
rightauth=psk
leftauth2=xauth
right=10.5.21.252
rightsubnet=10.140.0.0/20
xauth_identity= ubuntu_VPN
auto=add

 

Adding "rightsubnet=0.0.0.0/0" results in the full tunnel, Hence policy for VPN to WAN interface is needed and should be configured.
Another option is to set "auto=start" which starts the tunnel automatically everytime the Ubuntu client is restarted.

Another file that has to be edited is /etc/ipsec.secrets with below lines.

 

10.5.21.252 : PSK "abcd1234"
ubuntu_VPN : XAUTH "ubuntu"

 

Once completed, it is necessary to restart the strongswan service with the below commands as root.

 

#  systemctl restart strongswan

# ipsec update

# ipsec reload

 

To connect the tunnel run the below command as root.

 

#ipsec up FGT

 

Here FGT is the tunnel name configured in /etc/ipsec.conf.

 

Bringing up the tunnel will show below information.

 

# ipsec up FGT
initiating Main Mode IKE_SA FGT[1] to 10.5.21.252
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from 10.5.21.133[500] to 10.5.21.252[500] (252 bytes)
received packet: from 10.5.21.252[500] to 10.5.21.133[500] (204 bytes)
parsed ID_PROT response 0 [ SA V V V V V V ]
received NAT-T (RFC 3947) vendor ID
received DPD vendor ID
received XAuth vendor ID
received unknown vendor ID: 82:99:03:17:57:a3:60:82:c6:a6:21:de:00:00:00:00
received FRAGMENTATION vendor ID
received FRAGMENTATION vendor ID
selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 10.5.21.133[500] to 10.5.21.252[500] (268 bytes)
received packet: from 10.5.21.252[500] to 10.5.21.133[500] (252 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
sending packet: from 10.5.21.133[500] to 10.5.21.252[500] (108 bytes)
received packet: from 10.5.21.252[500] to 10.5.21.133[500] (92 bytes)
queueing TRANSACTION request as tasks still active
received packet: from 10.5.21.252[500] to 10.5.21.133[500] (92 bytes)
parsed ID_PROT response 0 [ ID HASH ]
parsed TRANSACTION request 3840560674 [ HASH CPRQ(X_TYPE X_USER X_PWD) ]
generating TRANSACTION response 3840560674 [ HASH CPRP(X_USER X_PWD) ]
sending packet: from 10.5.21.133[500] to 10.5.21.252[500] (108 bytes)
received packet: from 10.5.21.252[500] to 10.5.21.133[500] (92 bytes)
parsed TRANSACTION request 21457498 [ HASH CPS(X_STATUS) ]
XAuth authentication of 'ubuntu_VPN' (myself) successful
IKE_SA FGT[1] established between 10.5.21.133[10.5.21.133]...10.5.21.252[10.5.21.252]
scheduling reauthentication in 85803s
maximum IKE_SA lifetime 86343s
generating TRANSACTION response 21457498 [ HASH CPA(X_STATUS) ]
sending packet: from 10.5.21.133[500] to 10.5.21.252[500] (92 bytes)
generating TRANSACTION request 2585688889 [ HASH CPRQ(ADDR DNS) ]
sending packet: from 10.5.21.133[500] to 10.5.21.252[500] (92 bytes)
received packet: from 10.5.21.252[500] to 10.5.21.133[500] (108 bytes)
parsed TRANSACTION response 2585688889 [ HASH CPRP(ADDR DNS DNS) ]
installing DNS server 10.5.31.253 to /etc/resolv.conf
installing DNS server 96.45.46.46 to /etc/resolv.conf
installing new virtual IP 192.168.50.10
generating QUICK_MODE request 3030603905 [ HASH SA No ID ID ]
sending packet: from 10.5.21.133[500] to 10.5.21.252[500] (220 bytes)
received packet: from 10.5.21.252[500] to 10.5.21.133[500] (172 bytes)
parsed QUICK_MODE response 3030603905 [ HASH SA No ID ID ]
selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
CHILD_SA FGT{1} established with SPIs c72cb7eb_i 32618946_o and TS 192.168.50.10/32 === 10.140.0.0/20
generating QUICK_MODE request 3030603905 [ HASH ]
connection 'FGT' established successfully

 

Here the Ubuntu PC has received an IP address of 192.168.50.10 from the range defined on FortiGate.

 

It is possible to check the status of the tunnel using the below command.

 

# ipsec status
Security Associations (1 up, 0 connecting):
FGT[1]: ESTABLISHED 10 minutes ago, 10.5.21.133[10.5.21.133]...10.5.21.252[10.5.21.252]
FGT{1}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c72cb7eb_i 32618946_o
FGT{1}: 192.168.50.10/32 === 10.140.0.0/20

 

Testing connectivity using ping from Ubuntu CLI.

 

#ping 10.140.5.252
PING 10.140.5.252 (10.140.5.252) 56(84) bytes of data.
64 bytes from 10.140.5.252: icmp_seq=1 ttl=255 time=0.839 ms
64 bytes from 10.140.5.252: icmp_seq=2 ttl=255 time=0.432 ms
64 bytes from 10.140.5.252: icmp_seq=3 ttl=255 time=0.493 ms

 

aamin_0-1647677990346.png

 

To bring down the tunnel use the command.

 

# ipsec down FGT

 

To see more options for ipsec.conf and ipsec.secrets refer to the man pages in Ubuntu.

 

# man ipsec.conf

# man ipsec.secrets

 

Note.
For issues related to strongswan installation and configuration or any other issue post them in strongswan / ubuntu forums.

 

For more information on strongswan, the docs can be found at the below link
https://docs.strongswan.org/strongswan-docs/

Contributors