Description
This article demonstrates the deployment of OCVPN (Overlay Controller Virtual Private Network).
OCVPN is meant to be really fast and easy to configure because it will automatically create:
- Local and remote address groups.
- Routes.
- Policies.
- Phase 1 Configuration (+ tunnel interface).
- Phase 2 Configuration.
In this setup, there is the following:
- FortiGate VM01 with user Subnet 192.168.1.0/24 on port2.
- FortiGate VM02 with user subnet 192.168.2.0/24 on port2.
The aim is to be able to communicate between these 2 subnets by using an IPsec VPN.
Both FortiGates need to be registered on the support.fortinet.com portal (FortiCare).
Scope
FortiGate.
Solution
Go on the GUI under VPN -> Overlay Controller VPN of the first FortiGate VM01.
- Select 'Enabled' and role 'Spoke'.
-
After that, select 'Create New' under Overlays. Then enter the local subnet from VM01, which is in this case 192.168.1.0/24:
For VM02, follow the same step 1, then on step 2 configure the overlay as follows:
As illustrated in the above screenshot, it Is not required to put any subnet if the port2 is already configured with the correct subnet.
In this case, port2 is configured with 192.168.2.254/24 IP address, so the FortiGate has a connected route to this subnet.
Configuring the local subnet as 192.168.2.0/24 via the menu will also work.
After setting this select 'Apply'.
The overall configuration should look like this:
Configuring the local subnet as 192.168.2.0/24 via the menu will also work.
After setting this select 'Apply'.
The overall configuration should look like this:
The VPN should come up on the IPsec Monitor page:
If the VPN does not come up, double-check that Overlay Names are the same on both FortiGates as this is case-sensitive.
Note: The IPsec-based OCVPN service has been discontinued and licenses for it can no longer be purchased as of FortiOS 7.4.0. GUI, CLI, and license verification support for OCVPN have been removed from FortiOS. Upon upgrade, all IPsec phase 1 and phase 2 configurations, firewall policies, and routing configurations previously generated by the OCVPN service will remain. Alternative solutions for OCVPN are the Fabric Overlay Orchestrator in FortiOS 7.2.4 and later, and the SD-WAN overlay templates in FortiManager 7.2.0 and later.
This information has been included in FortiOS 7.4.4 release notes: Remove OCVPN support.
