OSPF-over-IPsec [Fortigate<>SRX]

Topology: 

 

Fortigate:

Interface Configuration:

config system interface

    edit "OSPF-over-ipsec"

        set vdom "root"

        set ip 1.1.1.8 255.255.255.255

        set allowaccess ping

        set type tunnel

        set remote-ip 1.1.1.200 255.255.255.0

        set snmp-index 5

        set mtu-override enable

        set mtu 1400

        set interface "port1"

    next

end

OSPF Configuration:

config router ospf

    set router-id 1.1.1.8

    config area

        edit 0.0.0.0

        next

        edit 0.0.0.1

        next

    end

    config ospf-interface

        edit "ipsec-tunnel"

            set interface "OSPF-over-ipsec"

            set dead-interval 40

            set hello-interval 10

            set network-type point-to-point

        next

        edit "port2"

            set interface "port2"

            set dead-interval 40

            set hello-interval 10

        next

    end

    config network

        edit 1

            set prefix 1.1.1.0 255.255.255.0

        next

        edit 2

            set prefix 14.140.40.0 255.255.255.0

            set area 0.0.0.1

        next

    end

    config redistribute "connected"

        set metric 4

    end

    config redistribute "static"

        set metric 3

    end

    config redistribute "rip"

    end

    config redistribute "bgp"

    end

    config redistribute "isis"

    end

end

SRX:

Interface Configuration:

set interfaces st0 unit 0 family inet mtu 1400

set interfaces st0 unit 0 family inet address 1.1.1.200/24

 

OSPF Configuration:

set routing-instances untrust routing-options router-id 1.1.1.200

set routing-instances untrust protocols ospf area 0.0.0.0 interface st0.0 hello-interval 10
set routing-instances untrust protocols ospf area 0.0.0.0 interface st0.0 dead-interval 40

set routing-instances untrust protocols ospf area 0.0.0.2 interface lo0.0 hello-interval 10
set routing-instances untrust protocols ospf area 0.0.0.2 interface lo0.0 dead-interval 40

 

or (if the interfaces are on default VR)

 

 

set  routing-options router-id 1.1.1.200

set  protocols ospf area 0.0.0.0 interface st0.0 hello-interval 10
set  protocols ospf area 0.0.0.0 interface st0.0 dead-interval 40

set  protocols ospf area 0.0.0.2 interface lo0.0 hello-interval 10
set  protocols ospf area 0.0.0.2 interface lo0.0 dead-interval 40

 

OSPF Status: 

SRX: