IKEv2 IPsec Config Fortigate


Interface: 

config system interface

    edit "port2"

        set vdom "root"

        set ip 14.140.40.108 255.255.255.0

        set allowaccess ping https

        set type physical

        set alias "WAN2"

        set role dmz

        set snmp-index 2

    next

    edit "port4"

        set vdom "root"

        set ip 20.20.20.108 255.255.255.0

        set allowaccess ping

        set type physical

        set alias "LAN"

        set snmp-index 8

    next

    edit "test"

        set vdom "root"

        set type tunnel

        set snmp-index 9

        set interface "port2"

    next

end


IKEv2 VPN:

config vpn ipsec phase1-interface

    edit "test"

        set interface "port2"

        set ike-version 2

        set peertype any

        set net-device disable

        set proposal aes256-sha256

        set dhgrp 2

        set nattraversal disable

        set transport udp

        set remote-gw 14.140.40.109

        set psksecret ENC Z/zEmBMV/OPXpUYpqce1Qhyyjw+lpLhe+mrMIoGfYWGP82ua9S2N6gmdjy7sqvysq0GBmjCGKhBe7Iqyst2jEVslwA84hpFSNWwvnE+ZpQsOe6NX0RBXQzw40qVmH7JbzdeYXgqtEmLZshpIuOudVh+OMvbbs9ojeu6xeUfIQ4/regrkDhal6CI12+HWo970gpf211lmMjY3dkVA

    next

end


config vpn ipsec phase2-interface
    edit "p2"
        set phase1name "test"
        set proposal aes256-sha256
        set dhgrp 14
        set src-subnet 20.20.20.0 255.255.255.0
        set dst-subnet 10.10.10.0 255.255.255.0
    next
end


Firewall Policy:


config firewall policy
    edit 1
        set name "allow"
        set uuid 67d5f8c4-7508-51ef-1eb7-0fd9ad5f2129
        set srcintf "test"
        set dstintf "port4"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set name "allow out"
        set uuid 9624287c-7508-51ef-482e-d2daf28580e8
        set srcintf "port4"
        set dstintf "test"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
    next
end

Route:

config router static

    edit 1

        set dst 10.10.10.0 255.255.255.0

        set device "test"

    next

end




Comments

Post a Comment

Popular posts from this blog

Configure IPsec site-to-site VPN in Linux Machine

Image
 Configure IPsec site-to-site VPN in Linux Machine: Update the system and install the package  apt update && sudo apt upgrade -y  apt install strongswan -y Check if the following kernel parameter is set or not sysctl net.ipv4.ip_forward=1 To list all configured parameters: sysctl -a root@ubuntu-server-main:~# sysctl net.ipv4.ip_forward=1 net.ipv4.ip_forward = 1 root@ubuntu-server-main:~# sysctl net.ipv4.conf.all.accept_redirects=0 net.ipv4.conf.all.accept_redirects = 0 root@ubuntu-server-main:~# sysctl net.ipv4.conf.all.send_redirects=0 net.ipv4.conf.all.send_redirects = 0 root@ubuntu-server-main:~# Network Diagram: IPsec Config: Configure the PSK and update the VPN endpoints ++++++++++++++ cat /etc/ipsec.secrets # source      destination 192.168.0.2   192.168.0.108 : PSK "87zRQqylaoeF5I8o4lRhwvmUzf+pYdDpsCOlesIeFA/2xrtxKXJTbCPZgqplnXgPX5uprL+aRgxD8ua7MmdWaQ" ++++++++++++++ cat /etc/ipsec.conf: config setup         charondebug="all"         uniqueids=yes  
Read more

TACACS+ Installation on Linux [CentOS]

 TACACS+  Installation on CentOS: In the example below I will show you how to install tac_plus on a CentOS server. There’s a RPM available so this will save you the hassle of compiling the source code yourself. Let’s add the repository first: [root@server ~]# cd /etc/yum.repos.d/ [root@server yum.repos.d]# vim nux-misc.repo We will create a new repository file where we can grab tac_plus. This is what you should enter: [nux-misc] name=Nux Misc baseurl=http://li.nux.ro/download/nux/misc/el6/x86_64/ enabled=0 gpgcheck=1 gpgkey=http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro Save the file and install tac_plus with the following command: [root@server ~]# yum --enablerepo=nux-misc install tac_plus That’s all you need to do. All configuration is done from a single config file. Let’s take a look at its contents: [root@server /]# vim /etc/tac_plus.conf You will see a lot of things in this default configuration file. Let me walk you through some of the fields. The first thing you see is a key,
Read more

Free Radius setup/configuration in Linux [Ubuntu/CentOS]

Free Radius setup/configuration in Linux [Ubuntu/CentOS]   1) Free RADIUS Client: CentOS:  yum install freeradius-utils Ubuntu: apt-get install freeradius-utils   2) Free RADIUS Server: Add the client device to free RADIUS server: i) vi /etc/freeradius/3.0/clients.conf  ii) Append below lines to the file above ############# client FortiGate-VM64-Xen {        ipaddr           = 192.168.0.108        secret           = testing123 } client sumit-linux-amp {        ipaddr           = 192.168.0.190        secret           = testing123 } #############   iii) Add users to the RADIUS server: Append below lines to the file "users" > vi /etc/freeradius/3.0/users #############  sumit1 Cleartext-Password := "password" sumit2 Cleartext-Password := "password"   #############   iv) restart the free RADIUS services: Ubuntu: > systemctl restart freeradius   CentOS: >  systemctl restart freeradius                   > sudo firewall-cmd --add-service={http,https,ra
Read more