Fortigate Firewall GRE tunnel Configuration

 Fortigate Firewall GRE tunnel Configuration:

 

GRE (Generic Routing Encapsulation):

> Encapsulation standard supported by almost all the major routing devices in the market

> Creates a virtual P-2-P link 

> Encapsulate the original packet into GRE header/packet with respective GRE source and GRE destination (GRE endpoints)

> Facilitate:   i) Private to Private communication over public/private network 

                      ii) Private to Public communication  over public/private network 

                     iii) Public to Public communication over public/private network

> No encryption supported with GRE, however some of the customized proprietary GRE (for eg. customized GRE  by HP), supports encryption as well

Network Topology:

Configuration Steps:

1) Configure WAN/LAN IP 

2) GRE tunnel configuration 

3) Point the interesting traffic to the GRE tunnel 

4) Firewall Rules 

CLI:

 ##########IP configuration##########

edit "port2"
        set vdom "root"
        set ip 14.140.40.109 255.255.255.0
        set allowaccess ping https ssh
        set type physical
        set snmp-index 2
    next

edit "Loopback"
        set vdom "root"
        set ip 33.33.33.33 255.255.255.255
        set allowaccess ping https ssh
        set type loopback
        set alias "DMZ"
        set role dmz
        set snmp-index 6
    next
end

 ########### GRE Tunnel  ###########

config system gre-tunnel
    edit "GRE-FG-01"
        set interface "port2"
        set remote-gw 14.140.40.130
        set local-gw 14.140.40.109
    next
end

########### Static Route##########

config router static
    edit 1
        set dst 10.10.10.130 255.255.255.255
        set device "GRE-FG-01"
    next
end

######### Outbound/Inbound Policy ##########

config firewall policy
    edit 1
        set name "GRE Allow"
        set uuid 05bd72a2-f374-51eb-8ec2-fae9b08d67a2
        set srcintf "Loopback"
        set dstintf "GRE-FG-01"
        set srcaddr "all"
        set dstaddr "remote-GRE"
        set action accept
        set schedule "always"
        set service "ALL_ICMP"
        set nat enable
    next
    edit 2
        set name "GRE Allow -IN"
        set uuid 315ae5b6-f374-51eb-7f54-1a3ffde94ec0
        set srcintf "GRE-FG-01"
        set dstintf "Loopback"
        set srcaddr "remote-GRE"
        set dstaddr "Loopback address"
        set action accept
        set schedule "always"
        set service "ALL_ICMP"
        set nat enable
    next
end

#########################################

Verify:

######### To check the GRE interface status ########

#get system int | grep -f GRE 

######### To capture the original traffic ########

#diagnose sniffer packet GRE-FG-01 "host 33.33.33.33 and host 10.10.10.130"

######### To capture the GRE encapsulated traffic########

#diagnose sniffer packet port2 "host 14.140.40.109 and host 14.140.40.130"

######### To check the GRE tunnel ############

#diagnose sys gre list

######## To check the static route pointing to GRE tunnel ########

#get router  info routing-table static

#########################################