Fortigate ipsec vpn with cisco ftd

背景：某分支机构设备升级至fortigate，替换原思科ASA防火墙，除基础网络如nat,policy等配置外还需完成与cisco ftd的ipsec连接，现记录如下。

Fortigate 侧：

1. 开启policy-based IPsec VPN功能

2. 添加Custom IPsec vpn

3. 取消勾选Enable IPsec Interface Mode.

4. 设置IPsec phase 1 的信息，特别注意proposal 中算法等的定义，fortigate与ftd设置差别蛮大。

5. 设置phase 2，proposal与感兴趣流，飞塔中如果涉及多条感兴趣流，你需要添加多个phase 2的selectors，且需要分别对每一个selectors设置proposalo。

6. 放通policy

7. 查看VPN的状态与流量，点击UP进去看详细流量

FTD侧：

1. 指定VPN模式，设置对端IP，对端感兴趣流，本端IP，本端感兴趣流

2. 设置IKE参数，也就是Phase 1 proposal参数。

请注意与飞塔的对比，此次使用的phase 1 proposal 为AES GCM 256, PRF SHA 1, DH 14 

 

3. 设置IPsec参数，也就是Phase 2 proposal参数

4. 放通Policy.

5. 查看VPN状态

CLI, 快准狠

Fortigate 侧：

config vpn ipsec phase1
    edit "Test-IPSec"
        set interface "wan1"
        set ike-version 2
        set peertype any
        set proposal aes256gcm-prfsha1
        set dhgrp 14
        set remote-gw 对端公网IP
        set psksecret 协商的key
    next
end
config vpn ipsec phase2
    edit "Test-IPSec"
        set phase1name "Test-IPSec"
        set proposal aes256-sha384 aes256gcm aes256-sha1
        set pfs disable
        set keylifeseconds 28800
        set src-subnet 本端感兴趣流
        set dst-subnet 对端感兴趣流
    next
    edit "Test-IPSec-2" #第二个感兴趣流
        set phase1name "Test-IPSec"
        set proposal aes256-sha384 aes256gcm aes256-sha1
        set dhgrp 14
        set keylifeseconds 28800
        set src-subnet 本端感兴趣流
        set dst-subnet 对端感兴趣流-2
    next
end
config firewall policy
    edit 2
        set name "Inside_2_IPSec"
        set srcintf "internal2"
        set dstintf "Outside_Zone"
        set action ipsec #actio的动作为ipsec
        set srcaddr "本端感兴趣流"
        set dstaddr "对端感兴趣流" "对端感兴趣流2"
        set schedule "always"
        set service "ALL"
        set inbound enable
        set vpntunnel "ipsec phase 1的名字"
    next

get vpn ipsec tunnel summar  #查看tunnel
get vpn ipsec tunnel details #查看tunnel

FTD侧：

FTD无法使用cli，show代码出来吧，跟ASA配置一样

crypto ikev2 enable Outside  #使能ikev2

#定义VPN类型，与key
tunnel-group 对端公网IP type ipsec-l2l
tunnel-group 对端公网IP general-attributes
 default-group-policy .DefaultS2SGroupPolicy
tunnel-group 对端公网IP ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****

crypto isakmp identity address
crypto ikev2 policy 2        #ikev2 phase1 proposal
 encryption aes-gcm-256
 integrity null
 group 14
 prf sha
 lifetime seconds 86400


crypto ipsec ikev2 ipsec-proposal CSM_IP_2   #ikev2 phase2 proposal
 protocol esp encryption aes-256
 protocol esp integrity sha-1


access-list CSM_IPSEC_ACL_1 extended permit ip 10.xx.0.0 255.255.0.0 10.xx.16.0 255.255.248.0    #permit 本端感兴趣流到对端感兴趣流
access-list CSM_IPSEC_ACL_1 extended permit ip 10.xx.2.0 255.255.255.0 10.xx.16.0 255.255.248.0  #permit 本端感兴趣流2到对端感兴趣流

crypto ipsec security-association pmtu-aging infinite
crypto map CSM_Outside_map 1 match address CSM_IPSEC_ACL_1
crypto map CSM_Outside_map 1 set peer 对端公网IP
crypto map CSM_Outside_map 1 set ikev2 ipsec-proposal CSM_IP_2
crypto map CSM_Outside_map 1 set reverse-route
crypto map CSM_Outside_map interface Outside