Configuring the Spoke FortiGates

This example shows the configuration for only one of the spokes. The parameters that need to change for each spoke are in red.

1. Configure phase 1 parameters.

   config vpn ipsec phase1-interface

   edit "ADVPN"

   set interface "wan1"

   set proposal des-sha1

   set add-route disable

   set dhgrp 2

   set auto-discovery-receiver enable

   set remote-gw 192.0.2.11

   set psksecret fortinet

   next

   end

2. Configure phase 2 parameters.

   config vpn ipsec phase2-interface

   edit "ADVPN-P2"

   set phase1name "ADVPN"

   set proposal des-sha1

   set auto-negotiate enable

   next

   end

3. Configure the tunnel interface IP.

   On the spokes, the remote IP is actually used and points to the IP defined on the hub.

   config system interface

   edit "ADVPN"

   set vdom "root"

   set ip 10.10.10.2 255.255.255.255

   set allowaccess ping

   set type tunnel

   set remote-ip 10.10.10.1

   set interface "wan1"

   next

   end

4. Configure iBGP.

   This is a static standard configuration. You can use redistribution instead of explicit route advertisement.

   config router bgp

   set as 65000

   set router-id 10.10.10.2

   config neighbor

   edit "10.10.10.1"

   set soft-reconfiguration enable

   set remote-as 65000

   set next-hop-self enable

   next

   end

   config network

   edit 0

   set prefix 192.168.2.0 255.255.255.0

   next

   end

   end

5. Configure a static route for the tunnel IP subnet.

   This step is important for the spokes as they need a summary route that identifies all tunnel IP addresses used in the topology to point to the ADVPN interface. This example uses 10.10.10.0/24 (for networks that expect fewer than 255 sites). Plan this IP range carefully as it is hardcoded in the spokes.

   config router static

   edit 0

   set dst 10.10.10.0 255.255.255.0

   set device "ADVPN"

   next

   end

6. Configure the following policies.

   config firewall policy

   edit 0

   set name "OUT ADVPN"

   set srcintf "lan"

   set dstintf "ADVPN"

   set srcaddr "all"

   set dstaddr "all"

   set action accept

   set schedule "always"

   set service "ALL"

   set status enable

   next

   edit 0

   set name "IN ADVPN"

   set srcintf "ADVPN"

   set dstintf "lan"

   set srcaddr "all"

   set dstaddr "all"

   set action accept

   set schedule "always"

   set service "ALL"

   set status enable

   next

   end