Basic site-to-site VPN with pre-shared key

This is a sample configuration of IPsec VPN authenticating a remote FortiProxy peer with a pre-shared key.

To configure IPsec VPN authenticating a remote FortiProxy peer with a pre-shared key in the GUI:

1. Configure the HQ1 FortiProxy.
   1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
      1. Enter a VPN name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiProxy.
      4. For NAT Configuration, select No NAT Between Sites.
      5. Click Next.
   2. Configure the following settings for Authentication:
      1. For Remote Device, select IP Address.
      2. For the IP address, enter 172.16.202.1.
      3. For Outgoing interface, enter port1.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter sample as the key.
      6. Click Next.
   3. Configure the following settings for Policy & Routing:
      1. From the Local Interface dropdown menu, select the local interface.
      2. Configure the Local Subnets as 10.1.100.0.
      3. Configure the Remote Subnets as 172.16.101.0.
      4. Click Create.
2. Configure the HQ2 FortiProxy.
   1. Go to VPN > IPsec Wizard and configure the following settings for VPN Setup:
      1. Enter a VPN name.
      2. For Template Type, select Site to Site.
      3. For Remote Device Type, select FortiProxy.
      4. For NAT Configuration, select No NAT Between Sites.
      5. Click Next.
   2. Configure the following settings for Authentication:
      1. For Remote Device, select IP Address.
      2. For the IP address, enter 172.16.2001.
      3. For Outgoing interface, enter port25.
      4. For Authentication Method, select Pre-shared Key.
      5. In the Pre-shared Key field, enter sample as the key.
      6. Click Next.
   3. Configure the following settings for Policy & Routing:
      1. From the Local Interface dropdown menu, select the local interface.
      2. Configure Local Subnets as 172.16.101.0.
      3. Configure the Remote Subnets as 10.1.100.0.
      4. Click Create.

To configure IPsec VPN authenticating a remote FortiProxy peer with a pre-shared key using the CLI:

1. Configure the WAN interface and default route. The WAN interface is the interface connected to the ISP. The IPsec tunnel is established over the WAN interface.
   1. Configure HQ1.

      config system interface 
          edit "port1"
              set vdom "root"
              set ip 172.16.200.1 255.255.255.0
          next
      end
      config router static
          edit 1
              set gateway 172.16.200.3
              set device "port1"
          next
      end

   2. Configure HQ2.

      config system interface
          edit "port25"
              set vdom "root"
              set ip 172.16.202.1 255.255.255.0
          next
      end
      config router static
          edit 1
              set gateway 172.16.202.2
              set device "port25"
          next
      end

2. Configure the internal (protected subnet) interface. The internal interface connects to the corporate internal network. Traffic from this interface routes out the IPsec VPN tunnel.
   1. Configure HQ1.

      config system interface
          edit "dmz"
              set vdom "root"
              set ip 10.1.100.1 255.255.255.0
          next
      end

   2. Configure HQ2.

      config system interface
          edit "port9"
              set vdom "root"
              set ip 172.16.101.1 255.255.255.0
          next
      end 

3. Configure the IPsec phase1-interface.
   1. Configure HQ1.

      config vpn ipsec phase1-interface
          edit "to_HQ2"
              set interface "port1"
              set peertype any
              set net-device enable
              set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
              set remote-gw 172.16.202.1
              set psksecret sample
          next
      end

   2. Configure HQ2.

      config vpn ipsec phase1-interface
          edit "to_HQ1" 
              set interface "port25"
              set peertype any
              set net-device enable
              set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
              set remote-gw 172.16.200.1
              set psksecret  sample
          next
      end

4. Configure the IPsec phase2-interface.
   1. Configure HQ1.

      config vpn ipsec phase2-interface
          edit "to_HQ2"
              set phase1name "to_HQ2"
              set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
              set auto-negotiate enable
          next
      end

   2. Configure HQ2.

      config vpn ipsec phase2-interface
          edit "to_HQ2"
              set phase1name "to_HQ1"
              set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
              set auto-negotiate enable
          next
      end

5. Configure the static routes. Two static routes are added to reach the remote protected subnet. The blackhole route is important to ensure that IPsec traffic does not match the default route when the IPsec tunnel is down.
   1. Configure HQ1.

      config router static
          edit 2
              set dst 172.16.101.0 255.255.255.0
              set device "to_HQ2"
          next
      

   2. Configure HQ2.

      config router static
          edit 2
              set dst 10.1.100.0 255.255.255.0
              set device "to_HQ1"
          next
      

6. Configure two firewall policies to allow bidirectional IPsec traffic flow over the IPsec VPN tunnel.
   1. Configure HQ1.

      config firewall policy
          edit 1
              set name "inbound"
              set srcintf "to_HQ2"
              set dstintf "dmz"
              set srcaddr "172.16.101.0"
              set dstaddr "10.1.100.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
          edit 2
              set name "outbound"
              set srcintf "dmz"
              set dstintf "to_HQ2"
              set srcaddr "10.1.100.0"
              set dstaddr "172.16.101.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
      end

   2. Configure HQ2.

      config firewall policy
          edit 1
              set name "inbound"
              set srcintf "to_HQ1"
              set dstintf "port9"
              set srcaddr "10.1.100.0"
              set dstaddr "172.16.101.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
          edit 2
              set name "outbound"
              set srcintf "port9"
              set dstintf "to_HQ1"
              set srcaddr "172.16.101.0"
              set dstaddr "10.1.100.0"
              set action accept
              set schedule "always"
              set service "ALL"
          next
      end

7. Run diagnose commands. The diagnose ipsec list-sa, diagnose ipsec list-conn, and diagnose ipsec p1-status commands are the key to troubleshoot why the IPsec tunnel failed to establish.