VPN ipSec: Fortigate<->pfSense

[leandroecomp]

Hi guys e same problem. I got a scenario with two pfSense firewalls site-to-site with ipSec. Working and well. But when try to config pfSense-to-Fortigate, I don' t have the same luck. If have done this challenge, please, post the solution here. I have a Fortigate 310B. Thanks.

[emnoc]

What version of pfSense and what have you configured? Pfsense is not very complex, just ensure your craft the proxy-ids to be exact match and avoid the 0.0.0.0/0:0 For the fortigate I prefer tunnel-interface and just match the same cipher, keylife and src/dst-subnet on the pfSense host. For keylife phase1 28800s for keylife ipsec-SA 3600s Both seems to do fine under 2.1RC1 pfsense, and these values are pretty much the defacto standard btw. If you would share your topology and the fortigate cfg, we can review it for you.

[leandroecomp]

Hi man. Thanks for your reply. This is the link with screens of the topology and config of the both firewalls. https://drive.google.com/file/d/0B5q2Sb3lH0UIRXZQRk1uZzV2NFk/edit?usp=sharing Tx.

[emnoc]

Screenshots are helpful & thanks. 1st thing I notice on pfSense unless my eyes are bad, you didn' t specify the local LAN subnet, but you match up the pfsense side of things to match the fortigate The fortigate stuff looks good. But I' m including the cfg in cli since I love the CLI :) config vpn ipsec phase1-interface edit " pfsense" set interface " wan1" set dpd disable set nattraversal disable set dhgrp 2 set proposal 3des-sha1 set remote-gw 200.30.0.1 set psksecret 123456 next end phase 2 config vpn ipsec phase2-interface edit " pfsense-p2" set auto-negotiate enable set keepalive enable set pfs disable set phase1name " pfsense" set proposal 3des-sha1 set replay disable set dst-subnet 192.168.1.0 255.255.255.0 set keylifeseconds 3600 set src-subnet 192.168.2.0 255.255.255.0 end static route config route static edit 28 set device " pfsense" set dst 192.168.1.0 255.255.255.0 set weight 50 next end fwpolicies ( all traffic allowed but you adjust for your setup ) config firewall address edit " LAN" set subnet 192.168.2.0/24 next edit " REMOTE1" set subnet 192.168.1.0/24 next config firewall policy edit 0 set srcintf " switch" set dstintf " pfsense" set srcaddr " LAN" set dstaddr " REMOTE1" set action accept set schedule " always" set service " ANY" next edit 0 set dstntf " switch" set srcintf " pfsense" set dstaddr " LAN" set srcaddr " REMOTE1" set action accept set schedule " always" set service " ANY" next

[leandroecomp]

Your post was very helpful. I only need to make some fixes in " Checking Proposal" and ... IT WORKS. Here' s the link for others to use also: https://drive.google.com/file/d/0B5q2Sb3lH0UIcjlkQV9KOWNZUzg/edit?usp=sharing Many thanks for your help friend. Bye!