Configure IPsec site-to-site VPN in Linux Machine

Route Based IPsec VPN between Fortigate and Juniper SRX Firewall

Topology:

 

Fortigate Configuration:

Phase1:

 config vpn ipsec phase1-interface
    edit "OSPF-over-ipsec"
        set interface "port1"
        set peertype any
        set net-device disable
        set proposal des-sha1
        set dhgrp 2
        set remote-gw 192.168.0.106
        set psksecret ENC abcd
    next
end

Phase2:

config vpn ipsec phase2-interface
    edit "OSPF-over-ipsec"
        set phase1name "OSPF-over-ipsec"
        set proposal des-sha1
        set pfs disable
    next
end

Policy:

config firewall policy

    edit 5
        set name "ipsec"
        set uuid a36a619c-32ec-51ec-8ce8-dbe87b1799e5
        set srcintf "OSPF-over-ipsec"
        set dstintf "port2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 6
        set uuid ac638986-32ec-51ec-2ed6-5f9cceb06d2b
        set srcintf "port2"
        set dstintf "OSPF-over-ipsec"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set comments " (Copy of ipsec) (Reverse of ipsec)"
    next

Route:

config router static
       edit 1
        set dst 33.33.33.33 255.255.255.255
        set device "OSPF-over-ipsec"
    next
end

SRX Configuration:

Phase 1:

set security ike proposal P1_proposal description Phase1_proposal

set security ike proposal P1_proposal authentication-method pre-shared-keys

set security ike proposal P1_proposal dh-group group2

set security ike proposal P1_proposal authentication-algorithm sha1

set security ike proposal P1_proposal encryption-algorithm des-cbc

set security ike proposal P1_proposal lifetime-seconds 86400

set security ike policy Phase1 mode main

set security ike policy Phase1 proposals P1_proposal

set security ike policy Phase1 pre-shared-key ascii-text "$9$vIIM7Vg4ZjkPJGUikqf5IEhrM8"

set security ike gateway Phase1_gateway ike-policy Phase1

set security ike gateway Phase1_gateway address 192.168.0.108

set security ike gateway Phase1_gateway dead-peer-detection probe-idle-tunnel

set security ike gateway Phase1_gateway external-interface ge-0/0/0

set security ike gateway Phase1_gateway local-address 192.168.0.106

set security ike gateway Phase1_gateway version v1-only

Phase 2:

set security ipsec proposal Phase2-proposal protocol esp
set security ipsec proposal Phase2-proposal authentication-algorithm hmac-sha1-96
set security ipsec proposal Phase2-proposal encryption-algorithm des-cbc
set security ipsec proposal Phase2-proposal lifetime-seconds 43200
set security ipsec policy Phase2_policy proposals Phase2-proposal
set security ipsec vpn ospf-over-ipsec bind-interface st0.0
set security ipsec vpn ospf-over-ipsec ike gateway Phase1_gateway
set security ipsec vpn ospf-over-ipsec ike ipsec-policy Phase2_policy

Route:

set routing-options static route 14.140.40.108/32 next-hop st0.0

Policy:

Allow policy from Untust to Untrsut

Tunnel status:

FG:

                                               

 

SRX: