FortiOS 5.2 Expert Recipe: BGP over a dynamic IPsec VPN

Source: Internet
Author: User
Keywords IPsec VPN BGP
Tags forticloud fortios fortinet vpn port fortigate ipsec vpn fortigate bgp

1. Configuring IPsec in FortiGate 1

Go to Policy & Objects > Objects > Addresses and select create new Address.

Then create Address Group.

Go to System > Status to look for CLI Console widget and create phase 1.

 config vpn ipsec phase1-interface
    edit Dialup
        set type dynamic
        set interface wan1
        set mode aggressive
        set peertype one
        set mode-cfg enable
        set proposal 3des-sha1 aes128-sha1
        set peerid dial
        set assign-ip disable
        set psksecret 
    next
end

Create phase 2.

 config vpn ipsec phase2-interface
    edit dial_p2
        set phase1name Dialup
        set proposal 3des-sha1 aes128-sha1
        set src-addr-type name
        set dst-addr-type name
        set src-name all
        set dst-name VPN_DST
    next
end

2. Configuring BGP in FortiGate 1

Go to System > Network > Interfaces and create a Loopback interface.

Go to System > Status to look for CLI Console widget and create BGP route.

 config router bgp
    set as 100
    set router-id 1.1.1.1
        config neighbor
            edit 10.10.10.10
                set ebgp-enforce-multihop enable
                set remote-as 200
                set update-source loop
            next
        end
        config redistribute connected
            set status enable
        end
end

3. Adding policies in FortiGate 1

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.

4. Configuring IPSec in FortiGate 2

Go to System > Status to look for CLI Console widget and create phase 1.

config vpn ipsec phase1-interface
    edit Dialup
        set interface wan1
        set mode aggressive
        set mode-cfg enable
        set proposal 3des-sha1 aes128-sha1
        set localid dial
        set remote-gw 172.20.120.22
        set assign-ip disable
        set psksecret 
    next
end

Create phase 2.

 config vpn ipsec phase2-interface
    edit dial_p2
        set phase1name Dialup
        set proposal 3des-sha1 aes128-sha1
        set keepalive enable
    next
end

5. Configuring BGP in FortiGate 2

Go to System > Network > Interfaces and create a Loopback interface.

Go to System > Status to look for CLI Console widget and create BGP route.

 config router bgp
    set as 200
    set router-id 1.1.1.2
        config neighbor
            edit 20.20.20.20
                set ebgp-enforce-multihop enable
                set remote-as 100
                set update-source loop
            next
        end
        config redistribute connected
            set status enable
        end
end

6. Adding policies in FortiGate 2

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.

Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.

7. Adding a static route in FortiGate 2

Go to Router > Static > Static Routes and add a route to the remote Loopback interface via Dialup interface.

8. Verifying tunnel is UP

Go to VPN > Monitor > IPsec Monitor to verify that the tunnel is UP.

9. Results

From FortiGate 1, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 2 were successfully advertised to FortiGate 1 via BGP.

From FortiGate 1,

Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.

get router info bgp summary 
BGP router identifier 1.1.1.1, local AS number 100
BGP table version is 8
2 BGP AS-PATH entries
0 BGP community entries
Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.10.10.10     4        200    8257    8237        7    0    0 5d00h01m        4
Total number of neighbors 1

From FortiGate 2, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 1 were successfully advertised to FortiGate 2 via BGP.

From FortiGate 2,

Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.

get router info bgp summary 
BGP router identifier 1.1.1.2, local AS number 200
BGP table version is 11
2 BGP AS-PATH entries
0 BGP community entries
Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
20.20.20.20     4        100    8341    8361       10    0    0 5d01h32m        3
Total number of neighbors 1
Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.