How to Dialup VPN Fortigate to Cisco Router

[Thien_Ly_Quang]

Hi all, How to Dialup VPN Cisco Router to Fortigate + Fortigate: Remote Gateway: Dialup User => any peer + Cisco Router: IPSEC VPN to Fortigate Help me please! Thanks

[emnoc]

Just config your fortigate as usual, and on the cisco install a wildcard any for the PSK since you have no clue as to what the peer address would be. crypto keyring cpe-keyring pre-shared-key address 0.0.0.0 0.0.0.0 key letmyfgtin ! That should be all that you need plus the correct fwpolices and routes

[Thien_Ly_Quang]

Hi emnoc, I want to config: + Cisco Router dialup VPN to Fortigate ( Wan ip address of Cisco Router is Dynamic, Wan ip address of Fortigate is Static ) Topo: [Cisco Router] {Dynamic IP} ---------> (Internet) --------->{Static IP} [Fortigate] Thanks so much!

[emnoc]

Than build the fortigate vpn for a dynamic where the peer ip_address is unknown. config vpn ipsec phase1-interface edit " t" set type dynamic set interface " EXT_NET01" set nattraversal enable set proposal aes256-sha1 aes128-sha1 next end

[Thien_Ly_Quang]

Hi emnoc, Thank you for your support. I have do that, but it' s not run My Topo: 192.168.158.30/28 |-------{port1}[Fortigate]{1.55.242.52} -------(Internet)-------{Dynamic IP}{g0/0}[Cisco Router] ------| looback0: 192.168.52.1/24 Bellow is router' s full config : ----------------------------------------------------------------------------- en conf t int g0/0 ip add dhcp no sh exit ip route 0.0.0.0 0.0.0.0 118.69.125.254 crypto isakmp enable crypto isakmp policy 10 encryption 3des authentication pre-share hash md5 group 5 lifetime 28800 exit crypto isakmp key 6 vietnam address 1.55.242.52 crypto ipsec transform-set TSET_VDI esp-3des esp-md5-hmac exit access-list 110 permit ip 192.168.52.0 0.0.0.255 192.168.158.16 0.0.0.15 crypto map CMAP_VDI 10 ipsec-isakmp match add 110 set peer 1.55.242.52 set pfs group5 set security-association lifetime seconds 1800 set transform-set TSET_VDI exit int g0/0 crypto map CMAP_VDI exit ip route 192.168.158.16 255.255.255.240 g0/0 ----------------------------------------------------------------------------- Help me please! Thanks you very much!

[emnoc]

ip route 192.168.158.16 255.255.255.240 g0/0

1st off you don' t need the above. The router will will encrypt and sent the traffic over the tunnel for the ACL #110, that static route would actually by-pass your crypto-map Next I built what I think you would deploy on the FGT, you would need to set the port-numbername but this is what you need to do for the basic VPN config vpn ipsec phase1-interface edit " tocisco-remote1" set type dynamic set interface " port1" set proposal 3des-md5 set psksecret vietnam next end config vpn ipsec phase2-interface edit " tocisco-p1" set phase1name " tocisco-remote" set proposal 3des-md5 set dst-subnet 192.168.52.0 255.255.255.0 set src-subnet 192.168.158.16 255.255.255.240 next end And finally you will need fwpolices and static route since we used interface mode in this example; route edit 100 set comment " VPN back to office " set device " tocisco-remote" set dst 192.168.52.0 255.255.255.0 next fwpolicy & address config firewall address edit LAN set subnet 192.168.158.30 255.255.255.240 next edit cisconet01 set subnet 192.168.52.0 255.255.255.0 next policy config firewall policy edit 0 set srcintf " port1" set dstintf " tocisco-remote" set srcaddr " LAN" set dstaddr " cisconet01" set action accept set schedule " always" set service " ANY" set comments " allow your local lan out to the cisco remote network" next edit 0 set dstintf " port1" set srcintf " tocisco-remote" set dstaddr " LAN" set srcaddr " cisconet01" set action accept set schedule " always" set service " ANY" set comments " allow the cisco remote network back to your lan" next I hope the above helps, but it' s quite simple. Just use a single proposal between your cisco and match pfs and that should be all that you need. And lastly, make sure the PSK identified are exact.