Fortinet FortiGate BOVPN Integration Guide

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, go to the documentation and support resources for that product.

This integration guide describes how to configure a Branch Office VPN (BOVPN) tunnel between a WatchGuard Firebox and a Fortinet FortiGate 60E.

Contents

• Fortinet FortiGate BOVPN Integration Guide
  • Contents
  • Integration Summary
  • Topology
  • Configure the Firebox
  • Configure the FortiGate 60E
    • Interface Settings
    • Enable Policy-based VPN
    • IPSec VPN Tunnels Settings
    • Policy Settings
    • Route Settings (Optional)
  • Test the Integration

Topology

This diagram shows the topology for a BOVPN connection between a Firebox and a Fortinet FortiGate 60E.

Configure the Firebox

On the Firebox, configure a BOVPN connection:

1. Log in to Fireware Web UI.
2. Select VPN > Branch Office VPN.
   The Branch Office VPN configuration page opens.
3. In the Gateways section, click Add.
4. In the Gateway Name text box, type a name to identify this Branch Office VPN gateway.
5. From the Address Family drop-down list, select IPv4 Addresses.
6. In the Credential Method section, select Use Pre-Shared Key.
   
7. In the adjacent text box, type the pre-shared key. Keep the String-Based option.

8. In the Gateway Endpoint section, click Add.
   The Gateway Endpoint Settings dialogue box opens.
9. From the External Interface drop-down list, select External.
10. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
    The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
11. Select By IP Address.
12. In the adjacent text box, type the primary IP address of the External Firebox interface.
    

13. Select the Remote Gateway tab.
14. Select Static IP Address.
15. In the adjacent text box, type the IP address of your Fortinet WAN connection.
16. Select By IP Address.
17. In the adjacent text box, type the IP address of your Fortinet WAN connection.
18. Keep the default settings for all other options.

19. Click OK.
20. In the Gateway Endpoint section, select the Start Phase 1 tunnel when Firebox starts check box.

21. Select the Phase 1 Settings tab.
22. From the Version drop-down list, select IKEv2.
23. Keep all other Phase 1 settings as the default values.

24. Click Save.
25. In the Tunnels section, click Add.

26. From the Gateway drop-down list, select gateway.1.
27. In the Addresses section, click Add.

28. In the Local IP section, from the Choose Type drop-down list, select Network IPv4.
29. In the Network IP text box, type the local IP segment. This IP address is the internal network that the VPN protects.
30. In the Remote IP section, from the Choose Type drop-down list, select Network IPv4.
31. In the Network IP text box, type the remote IP segment. This IP address is the internal network that the VPN protects.

32. Click OK.
33. Keep the default Phase 2 Settings.

34. Click Save.

35. Repeat the previous step to create another tunnel for another subnet. In our example, the second tunnel is named tunnel.2.

Configure the FortiGate 60E

Follow these steps to configure the interfaces, VPN settings, policies, and routes on your FortiGate device.

Interface Settings

1. Log in to the FortiGate 60E Web UI at https://<IP address of FortiGate 60E>. The default IP address is 192.168.1.99.
2. Select Network > Interfaces.
3. Configure the external interface (wan1) and the internal interface (internal2 and internal3). For information about how to configure interfaces, go to the Fortinet User Guide.

Enable Policy-based VPN

1. Select System > Feature Visibility.
2. Enable Policy-based IPsec VPN under Additional Features.
3. Click Apply.

IPSec VPN Tunnels Settings

1. Select VPN > IPsec Tunnels.

2. Click Create New > IPsec Tunnel.
3. In the Name text box, type the name. In our example, the name is To WG.
4. From the Template type options, select Custom to continue without a template.

5. Click Next.
6. Clear the Enable IPsec Interface Mode check box.
7. From the Remote Gateway drop-down list, select Static IP Address.
8. In the IP Address text box, type the public IP address of the Firebox. In our example, the IP address is 203.0.113.2.
9. From the Interface drop-down list, select wan1. Leave the default value for all other settings in the Network section.
10. In the Authentication section, from the Method drop-down list, select Pre-shared Key.
11. In the Pre-shared Key text box, type the pre-shared key.
12. In the IKE section, for Version, select 2.
13. In the Phase 1 Proposal section, remove all proposals except AES256 for encryption and SHA256 for authentication.
14. For the Diffie-Hellman Groups, select 14. Clear all other check boxes.
15. Leave the default value for all other Phase 1 settings.
16. In the Phase 2 Selectors section, from the Local Address drop-down list, select Subnet.
17. Type the local IP segment. This IP address is the internal network that the VPN protects.
18. From the Remote Address drop-down list, select Subnet.
19. Type the remote IP segment. This IP address is the internal network that the VPN protects.

20. Expand Advanced.
21. Remove all proposals except AES256 for encryption and SHA256 for authentication.
22. Enable Enable Replay Detection.
23. Enable Enable Perfect Forward Secrecy (PFS)
24. For the Diffie-Hellman Groups, select 14. Clear all other check boxes.
25. Leave the default value for all other Phase 2 settings.

26. Click OK.

27. Click Edit to edit this IPsec Tunnel.
28. Click Add under Phase 2 settings.

29. Repeat the previous step to create a new Phase 2 for another subnet.

30. Click OK.

Policy Settings

1. Select Policy & Objects > Addresses.

2. Click Create New > Address.
3. In the Name text box, type a name for the IP address. In our example, the name is WG_INT.
4. From the Type drop-down list, select Subnet.
5. In the IP/Netmask text box, type the IP segment.
6. Leave the default value for all other settings.

7. Click OK.
8. Repeat the previous step to create more IP segments.

9. Select Policy & Objects > Firewall Policy.

10. Click Create New.
11. In the Name textbook, type the object name. In our example, the name is Policy to WG.
12. From the Incoming Interface drop-down list, select internal2.
13. From the Outgoing Interface drop-down list, select wan1.
14. From the Source Address drop-down list, select FG_INT.
15. From the Destination Address drop-down list, select WG_INT.
16. From the Schedule drop-down list, select Always.
17. From the Service drop-down list, select All.
18. In the Action list, select IPsec.
19. From the VPN Tunnel drop-down list, select To WG.
20. Enable Allow traffic to be initiated from the remote site.
21. Leave the default value for all other settings.

22. Click OK.
    The policy that you created appears on this page.

23. Repeat the previous step to create another policy for another subnet.
    

Route Settings (Optional)

If you did not configure a gateway for the wan1 interface, you must add a route manually.

1. From the navigation menu, select Network > Static Routes.

2. Click Create New.
3. In the Destination > Subnet text box, type 0.0.0.0/0.0.0.0.
4. In the Gateway Address text box, type the IP address for your wan1 gateway.
5. From the Interface drop-down list, select wan1.
6. Leave the default value for all other settings.

7. Click OK.

Test the Integration

To test the integration, from Fireware Web UI:

1. Select System Status > VPN Statistics.
2. Verify that the 2 VPN tunnels are active.

To test the integration, from the FortiGate Web UI:

1. Select Dashboard > Network > IPsec.
2. Verify that the 2 VPN tunnels are active.

Finally, verify that the hosts successfully ping.