Fortigate as the vpn client

[dundunpew]

Hello,

I have a design where I need to connect n amount of fortigates via VPN to one VPN hub location.

I have come across various VPN templates however none of them includes a scenario where Fortigate acts like a HW VPN client like EZVPN scenario in Cisco.

If Fortigate has no such support, what would your recommendation be for rolling out mass amount of tunnels with least administrative overhead possible?

Thanks!

[emnoc]

Sorry to say EasyVPN is not supported function . What you can do, is to enable L2L vpn with peer-ids. basically at the hub you will define a peer-id for each spoke. I'm actually doing that right now . I'm assuming the hub is a another fortigate?

[dundunpew]

Thanks emnoc, I was expecting such answer.

The hub is openswan. Too bad that fortinet has not implemented a hw vpn client.

Good luck with your setup!

[emnoc]

You do have a peerif check option in openswan

left|rightid = <id>

how the left|right participant should be identified for authentication; defaults to left|right or the subject of the certificate configured with left|rightcert. Can be an IP address, a fully-qualified domain name, an email address, or a keyid. Prior to 5.0.0 fully-qualified domain names can be preceded by an @ to avoid them being resolved to an IP address.

Since 5.0.1 rightid for IKEv2 connections optionally takes a % as prefix in front of the identity. If given it prevents the daemon from sending IDr in its IKE_AUTH request and will allow it to verify the configured identity against the subject and subjectAltNames contained in the responder's certificate (otherwise, it is only compared with the IDr returned by the responder). The IDr sent by the initiator might otherwise prevent the responder from finding a config if it has configured a different value for leftid.

It would still require you to configure the headend  hub concentrator and set a unique rightid for reach remote spoke. You roll out a single psk  and with multiple connection statements with the right-subnets. Pfsense also works in this fashion also.

ken