FortiOS 5.2 Expert Recipe: BGP over a dynamic IPsec VPN

1. Configuring IPsec in FortiGate 1

Go to Policy & Objects > Objects > Addresses and select create new Address.

Then create Address Group.

Go to System > Status to look for CLI Console widget and create phase 1.

 config vpn ipsec phase1-interface
    edit Dialup
        set type dynamic
        set interface wan1
        set mode aggressive
        set peertype one
        set mode-cfg enable
        set proposal 3des-sha1 aes128-sha1
        set peerid dial
        set assign-ip disable
        set psksecret 
    next
end

Create phase 2.

 config vpn ipsec phase2-interface
    edit dial_p2
        set phase1name Dialup
        set proposal 3des-sha1 aes128-sha1
        set src-addr-type name
        set dst-addr-type name
        set src-name all
        set dst-name VPN_DST
    next
end

2. Configuring BGP in FortiGate 1

Go to System > Network > Interfaces and create a Loopback interface.

Go to System > Status to look for CLI Console widget and create BGP route.

 config router bgp
    set as 100
    set router-id 1.1.1.1
        config neighbor
            edit 10.10.10.10
                set ebgp-enforce-multihop enable
                set remote-as 200
                set update-source loop
            next
        end
        config redistribute connected
            set status enable
        end
end

3. Adding policies in FortiGate 1

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.

4. Configuring IPSec in FortiGate 2

Go to System > Status to look for CLI Console widget and create phase 1.

config vpn ipsec phase1-interface
    edit Dialup
        set interface wan1
        set mode aggressive
        set mode-cfg enable
        set proposal 3des-sha1 aes128-sha1
        set localid dial
        set remote-gw 172.20.120.22
        set assign-ip disable
        set psksecret 
    next
end

Create phase 2.

 config vpn ipsec phase2-interface
    edit dial_p2
        set phase1name Dialup
        set proposal 3des-sha1 aes128-sha1
        set keepalive enable
    next
end

5. Configuring BGP in FortiGate 2

Go to System > Network > Interfaces and create a Loopback interface.

Go to System > Status to look for CLI Console widget and create BGP route.

 config router bgp
    set as 200
    set router-id 1.1.1.2
        config neighbor
            edit 20.20.20.20
                set ebgp-enforce-multihop enable
                set remote-as 100
                set update-source loop
            next
        end
        config redistribute connected
            set status enable
        end
end

6. Adding policies in FortiGate 2

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.

7. Adding a static route in FortiGate 2

Go to Router > Static > Static Routes and add a route to the remote Loopback interface via Dialup interface.

8. Verifying tunnel is UP

Go to VPN > Monitor > IPsec Monitor to verify that the tunnel is UP.

9. Results

From FortiGate 1, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 2 were successfully advertised to FortiGate 1 via BGP.

From FortiGate 1,

Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.

get router info bgp summary 
BGP router identifier 1.1.1.1, local AS number 100
BGP table version is 8
2 BGP AS-PATH entries
0 BGP community entries
Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.10.10.10     4        200    8257    8237        7    0    0 5d00h01m        4
Total number of neighbors 1

From FortiGate 2, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 1 were successfully advertised to FortiGate 2 via BGP.

From FortiGate 2,

Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.

get router info bgp summary 
BGP router identifier 1.1.1.2, local AS number 200
BGP table version is 11
2 BGP AS-PATH entries
0 BGP community entries
Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
20.20.20.20     4        100    8341    8361       10    0    0 5d01h32m        3
Total number of neighbors 1