背景:某分支机构设备升级至fortigate,替换原思科ASA防火墙,除基础网络如nat,policy等配置外还需完成与cisco ftd的ipsec连接,现记录如下。
Fortigate 侧:
1. 开启policy-based IPsec VPN功能
2. 添加Custom IPsec vpn
3. 取消勾选Enable IPsec Interface Mode.
4. 设置IPsec phase 1 的信息,特别注意proposal 中算法等的定义,fortigate与ftd设置差别蛮大。
5. 设置phase 2,proposal与感兴趣流,飞塔中如果涉及多条感兴趣流,你需要添加多个phase 2的selectors,且需要分别对每一个selectors设置proposalo。
6. 放通policy
7. 查看VPN的状态与流量,点击UP进去看详细流量
FTD侧:
1. 指定VPN模式,设置对端IP,对端感兴趣流,本端IP,本端感兴趣流
2. 设置IKE参数,也就是Phase 1 proposal参数。
请注意与飞塔的对比,此次使用的phase 1 proposal 为AES GCM 256, PRF SHA 1, DH 14
3. 设置IPsec参数,也就是Phase 2 proposal参数
4. 放通Policy.
5. 查看VPN状态
CLI, 快准狠
Fortigate 侧:
config vpn ipsec phase1
edit "Test-IPSec"
set interface "wan1"
set ike-version 2
set peertype any
set proposal aes256gcm-prfsha1
set dhgrp 14
set remote-gw 对端公网IP
set psksecret 协商的key
next
end
config vpn ipsec phase2
edit "Test-IPSec"
set phase1name "Test-IPSec"
set proposal aes256-sha384 aes256gcm aes256-sha1
set pfs disable
set keylifeseconds 28800
set src-subnet 本端感兴趣流
set dst-subnet 对端感兴趣流
next
edit "Test-IPSec-2" #第二个感兴趣流
set phase1name "Test-IPSec"
set proposal aes256-sha384 aes256gcm aes256-sha1
set dhgrp 14
set keylifeseconds 28800
set src-subnet 本端感兴趣流
set dst-subnet 对端感兴趣流-2
next
end
config firewall policy
edit 2
set name "Inside_2_IPSec"
set srcintf "internal2"
set dstintf "Outside_Zone"
set action ipsec #actio的动作为ipsec
set srcaddr "本端感兴趣流"
set dstaddr "对端感兴趣流" "对端感兴趣流2"
set schedule "always"
set service "ALL"
set inbound enable
set vpntunnel "ipsec phase 1的名字"
next
get vpn ipsec tunnel summar #查看tunnel
get vpn ipsec tunnel details #查看tunnel
FTD侧:
FTD无法使用cli,show代码出来吧,跟ASA配置一样
crypto ikev2 enable Outside #使能ikev2
#定义VPN类型,与key
tunnel-group 对端公网IP type ipsec-l2l
tunnel-group 对端公网IP general-attributes
default-group-policy .DefaultS2SGroupPolicy
tunnel-group 对端公网IP ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
crypto isakmp identity address
crypto ikev2 policy 2 #ikev2 phase1 proposal
encryption aes-gcm-256
integrity null
group 14
prf sha
lifetime seconds 86400
crypto ipsec ikev2 ipsec-proposal CSM_IP_2 #ikev2 phase2 proposal
protocol esp encryption aes-256
protocol esp integrity sha-1
access-list CSM_IPSEC_ACL_1 extended permit ip 10.xx.0.0 255.255.0.0 10.xx.16.0 255.255.248.0 #permit 本端感兴趣流到对端感兴趣流
access-list CSM_IPSEC_ACL_1 extended permit ip 10.xx.2.0 255.255.255.0 10.xx.16.0 255.255.248.0 #permit 本端感兴趣流2到对端感兴趣流
crypto ipsec security-association pmtu-aging infinite
crypto map CSM_Outside_map 1 match address CSM_IPSEC_ACL_1
crypto map CSM_Outside_map 1 set peer 对端公网IP
crypto map CSM_Outside_map 1 set ikev2 ipsec-proposal CSM_IP_2
crypto map CSM_Outside_map 1 set reverse-route
crypto map CSM_Outside_map interface Outside