1. Configuring IPsec in FortiGate 1
Go to Policy & Objects > Objects > Addresses and select create new Address.
Then create Address Group.
Go to System > Status to look for CLI Console widget and create phase 1.
config vpn ipsec phase1-interface
edit Dialup
set type dynamic
set interface wan1
set mode aggressive
set peertype one
set mode-cfg enable
set proposal 3des-sha1 aes128-sha1
set peerid dial
set assign-ip disable
set psksecret
next
end
Create phase 2.
config vpn ipsec phase2-interface
edit dial_p2
set phase1name Dialup
set proposal 3des-sha1 aes128-sha1
set src-addr-type name
set dst-addr-type name
set src-name all
set dst-name VPN_DST
next
end
2. Configuring BGP in FortiGate 1
Go to System > Network > Interfaces and create a Loopback interface.
Go to System > Status to look for CLI Console widget and create BGP route.
config router bgp
set as 100
set router-id 1.1.1.1
config neighbor
edit 10.10.10.10
set ebgp-enforce-multihop enable
set remote-as 200
set update-source loop
next
end
config redistribute connected
set status enable
end
end
3. Adding policies in FortiGate 1
Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.
Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.
4. Configuring IPSec in FortiGate 2
Go to System > Status to look for CLI Console widget and create phase 1.
config vpn ipsec phase1-interface
edit Dialup
set interface wan1
set mode aggressive
set mode-cfg enable
set proposal 3des-sha1 aes128-sha1
set localid dial
set remote-gw 172.20.120.22
set assign-ip disable
set psksecret
next
end
Create phase 2.
config vpn ipsec phase2-interface
edit dial_p2
set phase1name Dialup
set proposal 3des-sha1 aes128-sha1
set keepalive enable
next
end
5. Configuring BGP in FortiGate 2
Go to System > Network > Interfaces and create a Loopback interface.
Go to System > Status to look for CLI Console widget and create BGP route.
config router bgp
set as 200
set router-id 1.1.1.2
config neighbor
edit 20.20.20.20
set ebgp-enforce-multihop enable
set remote-as 100
set update-source loop
next
end
config redistribute connected
set status enable
end
end
6. Adding policies in FortiGate 2
Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from Dialup to loop interfaces.
Go to Policy & Objects > Policy > IPv4 and create a policy allowing BGP traffic from loop to Dialup interfaces.
7. Adding a static route in FortiGate 2
Go to Router > Static > Static Routes and add a route to the remote Loopback interface via Dialup interface.
8. Verifying tunnel is UP
Go to VPN > Monitor > IPsec Monitor to verify that the tunnel is UP.
9. Results
From FortiGate 1, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 2 were successfully advertised to FortiGate 1 via BGP.
From FortiGate 1,
Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.
get router info bgp summary
BGP router identifier 1.1.1.1, local AS number 100
BGP table version is 8
2 BGP AS-PATH entries
0 BGP community entries
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.10.10.10 4 200 8257 8237 7 0 0 5d00h01m 4
Total number of neighbors 1
From FortiGate 2, Go to Router > Monitor > Routing Monitor and verify that routes from FortiGate 1 were successfully advertised to FortiGate 2 via BGP.
From FortiGate 2,
Go to System > Status to look for CLI Console widget and type this command to verify BGP neighbors.
get router info bgp summary
BGP router identifier 1.1.1.2, local AS number 200
BGP table version is 11
2 BGP AS-PATH entries
0 BGP community entries
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
20.20.20.20 4 100 8341 8361 10 0 0 5d01h32m 3
Total number of neighbors 1