FortiGATE 90D to SRX210H

[glaberge]

Hello,

I am at my wits end and looking for some assistance if anyone feels so inclined.  I have a Hub and Spoke VPN running all SRXs right now and we have decided to move the spokes to FortiGATEs-- however, for the life of me I cannot get it to work.

Some details:

- Spokes (FortiGATES) are Dynamic IPs.

- HUB (SRX) is a Static IP.

SRX:

[edit]

#show security ike

policy ITG_Remote_Main_Policy { mode aggressive; proposal-set standard; pre-shared-key ascii-text "XXX"; ## SECRET-DATA }

gateway LABERGE_GATE { ike-policy ITG_Remote_Main_Policy; dynamic inet 1.1.1.1; external-interface ge-0/0/0; }

[edit]

#show security ipsec

policy ITG_Remote_Main_Policy { proposal-set standard; }

vpn LABERGE_VPN { bind-interface st0.4; ike { gateway LABERGE_GATE; ipsec-policy ITG_Remote_Main_Policy; } }

I only have the SRX side to share right now because that really shouldn't need to change.  It works SRX to SRX just fine.

I have tried everything I can think of on the FortiGATE side to get them to talk, support (both Juniper and FortiNET) has tried as well and nothing.  Neither side will talk to the other.

I have erased my FortiGATE VPN configuration to start from scratch.  Any pointers someone can give me would be immensely helpful.

Halp.

GLABERGE

[ede_pfau]

hi,

when you pair VPN gateways with at least one member with a dynamic IP address then you have to resort to Aggressive Mode (which you have) plus peerID (which you don't) to identify mutually.

Besides, connecting a FGT to a non-FGT VPN gateway will almost always require the Quick Mode selectors (a.k.a. proxy IDs) to be specific for the subnets behind each gateway. You cannot work with the default 'wildcard' address 0.0.0.0/0 .

I don't see any specification of these in your post.

And really, Fortinet support was not able to solve this? After all, Juniper is not unknown in the router/gateway market. I suspect you could find config examples either in the KB or in the forums.

[emnoc]

Nave no fear, "emnoc" is here. 

We will need the  FGT side of the cfg and the "standard" proposals will limited you to your proposal that needs to match the  FGT.

Also you don't need to change anything on the SRX side of things. Lastly, you can use proxy-ids of 0.0.0.0/0:0 on the SRX side and in the same fashion as the FGT, but like ede suggestion you should place specific srsc/dst-subnets

Here's a cfg that uses ikve1 between SRX and FGT

http://socpuppet.blogspot.com/2013/09/vpn-ikev2-juniper-to-fortigate-routevpn.html

This should give you an ideal of whats required.If you dump your FGT side configuration, I will write you a  FGT routed-based vpn. Just add your PSK and the remote-gateway ;)

[glaberge]

Thank you both for your replies.

Which part of the FortiGATE configuration do you need?  Just the VPN configuration or the entirety of it?

Thanks,

GLABERGE

[emnoc]

The phase1 + 2, Sanitize the  Public-address for remote-gateway. Do you need to redefine ike/ipsec proposals or is the proposal set  "standard" going to stay on the SRX? I will build you cfg as a route-based version  policy-base which is the general recommendation for both JNPR and FTNT

[glaberge]

config vpn ipsec phase1-interface

 edit "ITG_DC_GATE-P1"

 set interface "wan1"

 set mode aggressive

 set proposal 3des-sha1

 set localid "10.0.1.254"

 set dhgrp 2

 set remote-gw 1.1.1.1

 set psksecret ENC <blanked>

 next

end

config vpn ipsec phase2-interface

 edit "ITG_DC_GATE-P2"

 set phase1name "ITG_DC_GATE-P1"

 set proposal 3des-sha1

 set dhgrp 2

 next

end

I can build a new policy on the SRX to use compatible if that's better.

[emnoc]

What's the local subnets on both sides of the vpn?

  SRC == ?

  DST == ?

What's your  diag debug app ike -1  output?

diag debug reset

diag debug en

diag debug app ike -1 

Also what are you phase1 status  as-is now while it doesn't work ?  Did you re-key the  PSK key? ( the above diagnostic will show you  if you had a PSK mismatch )

SRX-junos

show security ike security-associtatio

FGT

diag vpn ike gateway list name ITG_DC_GATE-P1

If this shows the up, than you can now validate the  phase2 & move on, if not you need further diagnostics.

SRX-junos

show security ipsec security-association

FGT

 diag vpn tunnel list name <insert vpn name>

At this point the SPIs for in/out should match the juniper and any problems from this point  are routes or fwpolicies;

And yes I would rebuild the proposals on the  ike /ipsec levels and defined them within the proposal definitions, but compatible should be okay for 3des-sha1,  I would change "proposal-set standard;" to "proposal-set compatibile;" or set the   ike/ipsec prosposals as outline in the below link.

http://socpuppet.blogspot.com/2014/12/juniper-proposal-sets-ikeipsec.html?showComment=1418677447741

Keep in mind to place routes on the juniper side & the tunnel st.X  ( where X is your tunnel numebr )

SRX juniper

set routing-options static route 192.0.2.0/24 next-hop st0.X

and the same for the FGT

config router static

   edit 6666

        set  dst net 192.0.3.0/24

         set device "ITG_DC_GATE-P1" end

http://socpuppet.blogspot.com/2013/09/vpn-ikev2-juniper-to-fortigate-routevpn.html