TLS 1.3 based VPN over TCP

IKE based VPN tunnels can be configured to be ESP, UDP or TCP based. When TCP is used as the transport protocol, IKE and ESP packets are encapsulated in TCP in the port that you specified.

In this enhancement, TLS 1.3 is added as an option for VPN over TCP. The TLS option can be selected when Allow VPN negotiation over TCP is enabled in the VPN > VPN Tunnels > Settings page. With TLS enabled, IKE and ESP traffic are transported over TLS.

For information about configurations and usage, see Tunnel and encapsulation settings.

Example

An IKEv2 over TLS 1.3 VPN tunnel is formed between a VPN Client (FGTA) and a dialup VPN Gateway (FGTD).

To configure the hub FortiGate, FGTD, in the GUI:

1. Go to VPN > VPN Tunnels and select the Settings tab.

2. Enable Allow VPN negotiation over TCP.

3. Enable Use TLS.

4. Click OK.

5. Go to VPN > VPN Tunnels, select the Tunnels tab, and click Create new > Custom IPsec tunnel.

6. Configure the following settings:

   Field	Value
   Name	tofgta
   Remote gateway	Dialup user
   Interface	port13
   Authentication Method	Signature
   Certificate name	Select your certificate
   IKE	Version 2 (default)

7. In the Phase 2 selectors table, click Create New and configure the following:

   Field	Value
   Name	tofgta
   Encryption – authentication	Remove all SHA1 based entries

8. Click OK to save the phase 2 selector.

9. Click OK to save the tunnel.

10. Create firewall policies to allow traffic from tofgta to a protected network, and to allow traffic from a protected network to tofgta.

To configure the hub FortiGate, FGTD, in the CLI:

config system settings
    set ike-tcp-service enable
    set ike-tls-service enable
end

config vpn ipsec phase1-interface
    edit "tofgta"
        set type dynamic
        set interface "port13"
        set ike-version 2
        set authmethod signature
        set peertype any
        set net-device disable
        set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
        set dhgrp 20 21
        set certificate "test1"
    next
end

config vpn ipsec phase2-interface
    edit "tofgta"
        set phase1name "tofgta"
        set proposal aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set dhgrp 20 21
    next
end

config firewall policy
    edit 1
        set srcintf "port2"
        set dstintf "tofgta"
        set action accept
        set srcaddr "192.168.5.0"
        set dstaddr "10.1.100.0"
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set srcintf "tofgta"
        set dstintf "port2"
        set action accept
        set srcaddr "10.1.100.0"
        set dstaddr "192.168.5.0"
        set schedule "always"
        set service "ALL"
    next
end

To configure the dialup client FortiGate, FGTA, on the GUI:

1. Go to VPN > VPN Tunnels and select the Settings tab.

2. Enable Allow VPN negotiation over TCP.

3. Enable Use TLS.

4. Click OK.

5. Go to VPN > VPN Tunnels, select the Tunnels tab, and click Create new > Custom IPsec tunnel.

6. Configure the following settings:

   Field	Value
   Name	tofgtd
   Remote gateway	Static IP address
   IP address	173.1.1.1
   Interface	port9
   Transport	Auto
   Authentication Method	Signature
   Certificate name	Select your certificate
   IKE	Version 2 (default)

7. In the Phase 2 selectors table, click Create New and configure the following:

   Field	Value
   Name	tofgtd
   Encryption – authentication	Remove all SHA1 based entries

8. Click OK to save the phase 2 selector.

9. Click OK to save the tunnel.

10. Create firewall policies to allow traffic from tofgtd to a protected network, and to allow traffic from a protected network to tofgtd.

To configure the dialup client FortiGate, FGTA, on the CLI:

config system settings
    set ike-tcp-service enable
    set ike-tls-service enable
end

config vpn ipsec phase1-interface
    edit "tofgtd"
        set interface "port9"
        set ike-version 2
        set authmethod signature
        set peertype any
        set net-device disable
        set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
        set dhgrp 20 21
        set transport auto
        set remote-gw 173.1.1.1
        set certificate "test3"
    next
end

config vpn ipsec phase2-interface
    edit "tofgtd"
        set phase1name "tofgtd"
        set proposal aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set dhgrp 20 21
    next
end

config firewall policy
    edit 1
        set srcintf "port2"
        set dstintf "tofgtd"
        set action accept
        set srcaddr "10.1.100.0"
        set dstaddr "192.168.5.0"
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set srcintf "tofgtd"
        set dstintf "port2"
        set action accept
        set srcaddr "192.168.5.0"
        set dstaddr "10.1.100.0"
        set schedule "always"
        set service "ALL"
    next
end

Verification

When the tunnel is established, run the following debugs on FGTA to verify:

# diagnose vpn ike gateway list

vd: root/0
name: tofgtd
version: 2
interface: port9 15
addr: 11.101.1.1:443 -> 173.1.1.1:7179
tun_id: 173.1.1.1/::173.1.1.1
remote_location: 0.0.0.0
network-id: 0
transport: TLS
tcp-tx-1m-rate : 0 kbps
tcp-tx-5m-rate : 0 kbps
tcp-tx-drop    : 0
tcp-rx-1m-rate : 0 kbps
tcp-rx-5m-rate : 0 kbps
tcp-rx-drop    : 0
created: 4968s ago
peer-id: C = CA, ST = BC, L = Burnaby, O = Fortinet, OU = QA, CN = test3
peer-id-auth: yes
pending-queue: 0
PPK: no
IKE SA: created 1/2  established 0/1  time 0/0/0 ms
IPsec SA: created 1/2  established 1/1  time 0/0/0 ms

  id/spi: 3 823c08a1ddd29111/9e2f8c8339d5ba43
  direction: responder
  status: established 4948-4948s ago = 0ms
  proposal: aes128-sha256
  child: no
  SK_ei: bf126e0a84efa7ff-8d6e8c56694a1850
  SK_er: 78c57cbadd9d949c-ff88391ff06083ee
  SK_ai: 451eec850591848d-10d9deae1e58df5a-741e1cadf1922d98-a81086392bcfd0e2
  SK_ar: c83ecb5fb337286a-908b54e1454e859f-8e5ad8c4fd5184c3-48ea79a494ad6bef
  PPK: no
  message-id sent/recv: 0/2
  QKD: no
  PQC-KEM (IKE): no
  PQC-KEM (all IPsec): no
  lifetime/rekey: 86400/81181
  DPD sent/recv: 00000000/00000000
  peer-id: C = CA, ST = BC, L = Burnaby, O = Fortinet, OU = QA, CN = test3

To verify the TLS connection in IPsec VPN tunnel real-time debugs:

# diagnose debug application ike 127

ike V=root:0:tofgtd: going to be deleted
ike V=root:0:tofgtd: reset TCP ports and transport mode
...
ike V=root:tcp deletes tcp-transport(vd=0, vrf=0, intf=15:15, 11.101.1.1:443->173.1.1.1:7179 sock=43 refcnt=2 ph1=0x55c2b67379e0) (1).
ike V=root:tcp destroys tcp-transport(vd=0, vrf=0, intf=15:15, 11.101.1.1:443->173.1.1.1:7179 sock=43 refcnt=0 ph1=(nil)) (0).
ike V=root:0:tofgtd: set oper down
ike V=root:0:tofgtd: schedule auto-negotiate
ike V=root:0:tofgtd: auto-negotiate connection
ike V=root:0:tofgtd:tofgtd: created connection: 0x55c2b673f5d0 15 11.101.1.1->173.1.1.1:443.
ike V=root:0:tofgtd:tofgtd: chosen to populate IKE_SA traffic-selectors
ike V=root:0:tofgtd: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiation
ike V=root:tls connection is inprogress tcp-transport(vd=0, vrf=0, intf=15:15, 11.101.1.1:7007->173.1.1.1:443 sock=41 refcnt=2 ph1=0x55c2b6730a10) (1).
ike V=root:0:tofgtd:4: generate DH public value request pending
ike V=root:tcp accepts ike tcp-transport(vd=0, vrf=0, intf=0:15, 11.101.1.1:443->173.1.1.1:4205 sock=43 refcnt=2 ph1=(nil)) (2).
ike V=root:tls connecting, ssl_want(2)
ike V=root:tls accepting.
ike V=root:tls connected, IKE tcp prefix sent
ike V=root:0:tofgtd:4: create NAT-D hash local 11.101.1.1/7007 remote 173.1.1.1/443
ike V=root:tls accepted tcp-transport(vd=0, vrf=0, intf=0:15, 11.101.1.1:443->173.1.1.1:4205 sock=43 refcnt=2 ph1=(nil)).
ike V=root:tls verified connection tcp-transport(vd=0, vrf=0, intf=0:15, 11.101.1.1:443->173.1.1.1:4205 sock=43 refcnt=2 ph1=(nil)).
ike V=root:0: tcp comes 173.1.1.1:443->11.101.1.1:7007,ifindex=15,vrf=0,len=264....
...