Hub-and-spoke IPSEC VPN Configuration

The 1,ipsec VPN application is more and more extensive, the following configuration instance is to the single headquarters multiple branch organization actual application

According to the configuration of this article, we can achieve the maximum VPN connectivity through the minimum number of VPN tunnels, the network topology is as follows:

As shown above, the Headquarters firewall machine hub firewall name is fortigate_1, its external network port IP address is: 172.16.10.1, the Headquarters intranet has 2 different department subnets respectively is the finance subnet (Finance network), The address is: 192.168.12.0/24 Human resource subnet (HR network), address is: 192.168.22.0/24;

There are 2 branches, one of the branches of the firewall name is called Spoke_1, its external network port IP address is: 172.16.20.1, intranet address is: 192.168.33.0/24; another branch office firewall name is Spoke_ 2, its external network port IP address is: 172.16.30.1, intranet address is: 192.168.44.0/24.

As this article is configured, we can eventually use a total of 2 VPN implementations with 2 different VPN schemes to achieve the mutual access requirements of 3 to 4 protected subnets.

2, policy-based VPN (channel mode)

Typically, the IPSec VPN gateway implements patterns that are based on a protected and protected subnet, which is a model of VPN policy, also known as policy-based VPN mode, described in detail below.

2. 1 Configuration Fortigate_1

2. 1. 1 Configuring IPSec VPN Phase One

Login to Fortigate_1 Web interface, enter virtual private network----IPSEC----automatically exchange key (IKE), new stage One,

Name: Spoke_1

Remote gateway: Static IP Address

IP Address: 172.16.20.1

Local interface: Wan1

Mode: Main Mode

Authentication mode: Pre-shared key

Pre-shared secret key: 123456

Click the Advanced option, remove the "Start IPSec interface mode" Before the tick, the other configuration using the default settings, the specific configuration as shown in the following figure:

Use the same method to configure another VPN to spoke_2, as follows: