Creating a Fortigate Site-to-Site IPsecVPNPOSTED ON23/08/2013For theVPN tunnelwe used the following topology:

Creating Fortigate VPN Steps:I. Go to VPN > IPsec ->Auto Key (IKE) and select Create Phase 1

II. Enter the following information in Phase1

Name:Fortigate_VPN 1-This is a name to identify the VPN tunnel, you must remember this name as it will appear when configuration the Phase2.Remote Gateway Enter the static IP of the VPN remote peer. In our example it is 2.2.2.2Local Interface Select the interface that has outside Internet access. In our case we picked WAN1.Note: This interface cannot be a loopback interface.Mode: Main ModeAuthentication: Pre Shared Key -> pick a share key with more than 6 letters.ClickAdvanced:Select theP1 Proposals(we picked):Encryption:3DESAuthentication:MD5DH Group:2Keylive:28800Local ID:XAUTH: DisabledNAT Traversal:DisabledDead Peer Detection:Disable Note:please keep in mind to set this to disabled in case you are peering with another VPN vendor. I have found out that this can break the VPN tunnelClick OKThe VPN Phase1 one was now created successful.III. Now we need to create VPN Phase2, below are the steps:

Name: Select a name that suits you, we picked Phase2_Fortigate_VPN1Phase1: Select the name of the Phase1 you created earlier. We pickedFortigate_VPN1Encryption: 3DESAuthentication: MD5Quick Mode Selector: This describes the IP ranges that you want passing through the VPN.As in the picture, we picked:The Source Address: 10.10.10.0/24 , that is behind our Fortigate_1 VPN appliance.The Destination Address: 10.20.20.0/24. that is behind our Fortigate_2 VPN appliance.IV. Define VPN Source Selectors1. Create a firewall address, go toFirewall Objects > Addresses > Addressand select Create New.Enter the following information and press OK:Address Name: Sales_NetworkSubnet/IP Range: 10.10.10.0/242. Create another firewall address( that is behind Fortigate 2) and go toFirewall Objects > Addresses > Addressand select Create New.Enter the following information and press OK:Address Name: Remote_Sales_NetworkSubnet/IP Range: 10.20.20.0/24V. Create a Firewall Policy on the Fortigate:a. Go toPolicy > Policyb. Select Create Newc. Enter the following information and press OKSource Interface/Zone SelectInternalSource Address Name Select Sales_NetworkDestination Interface/Zone SelectWAN1Destination Address Name Remote_Sales_NetworkAction IPSECVPN tunnel: Fortigate_VPN1Select ONLY the following option: Allow Inbound and Allow OutboundEverything should be up and running now.