FortSASE - BGP Router ID Subnet

[Ajay_M]

Hi Fortinet Team,

 We are trying to bring up Dial-up vpn tunnel between FortiSASE POPs and Fortigate SPA Hub. 

Fortigate SPA Hub BGP neighbor range is 172.31.2.0/24.

Fortigate SPA Hub loopback ip is 172.31.2.1/32

Spoke ip is 172.31.2.2/32

But when we assigning BGP Router ID Subnet is 172.31.2.0/24. FortiSASE POPs are getting assigned with 172.31.2.1/32 (Primary POP) and 172.31.2.2/32 (Secondar POP), but those IPs are assigned in our SD-WAN SPA Hub and spoke, due to that BGP is not coming up.

We referred this FortiSASE POP to FortiGate SPA Hub BGP co... - Fortinet Community still facing the issue.

Expecting clear recommended config and config

#Fortisase

Thanks,

Ajay M

[Anthony_E]

Hello Ajay,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hi Ajay,

To bring up a dial-up VPN tunnel between FortiSASE PoPs and a FortiGate SPA Hub, 

1. Configure FortiGate as IPsec Server (Hub): Set up the FortiGate in your data center as the IPsec server.  Enable BGP on the FortiGate. Configure ADVPN in sender mode.  Enable mode-cfg. Assign a unique network-id to each Hub.
2. Configure FortiSASE as Dial-up Client (Spoke): Access the FortiSASE console. Navigate to Network -> Secure Private Access. - Select the 'Network Configuration' tab. - Define common parameters for the connection to the on-prem FortiGate devices.
3. Psec VPN Settings: Use IKEv2 for the VPN. Enable mode config to allow FortiSASE PoPs to acquire IP addresses dynamically. Set up BGP peering using the acquired IP addresses. - Establish one overlay tunnel per underlay, even if multiple WAN underlays exist. - Use network overlay IDs for each tunnel by configuring `set network-overlay enable` and `set network-id <n>`. Configure a preshared key for each overlay tunnel. 
4. Phase 1 and Phase 2 Proposals:For Phase 1, use proposals like aes128-sha256, aes256-sha256, aes128-sha1, aes256-sha1, with DH groups 14 and 5
5. For Phase 2, use proposals like aes128-sha1, aes256-sha1, aes128-sha256, aes256-sha256, aes128gcm, aes256gcm, chacha20poly1305, with DH groups 14 and 5.
6. Enable ADVPN on Hub: Configure the hub with `set auto-discovery-sender enable` to enable ADVPN.