{"id":4360,"date":"2022-10-05T10:17:27","date_gmt":"2022-10-05T17:17:27","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=4360"},"modified":"2022-10-05T10:17:30","modified_gmt":"2022-10-05T17:17:30","slug":"how-to-set-up-site-to-site-vpn-on-fortigate-firewall","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=4360","title":{"rendered":"How to Set up Site-to-Site VPN on FortiGate Firewall"},"content":{"rendered":"\n<p><strong>Note<\/strong>: If your device\/service supports SHA256 and DH group 14, it is recommended to use these settings instead.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configuring-the-tunnel-at-the-fortigate-management-interface\">Configuring the tunnel at the FortiGate Management Interface<\/h3>\n\n\n\n<ol class=\"wp-block-list\"><li>Open the FortiGate Management Interface<\/li><li>In the left panel, select VPN, then IPsec Tunnels, and select Create New<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/01%20Setting%20up%20site-to-site%20on%20FortiGate.png\" alt=\"01 Setting up site-to-site on FortiGate.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\"><li>In the VPN Creation Wizard window set the Name to NordLayer (or any other name you desire), the Template Type to Custom tab, and select Next<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/02%20Setting%20up%20site-to-site%20on%20FortiGate.png\" alt=\"02 Setting up site-to-site on FortiGate.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\"><li>Fill in the following information:<\/li><\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"network-section\">Network Section:<\/h4>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>IP Version<\/strong>: IPv4<\/li><li><strong>Remote Gateway<\/strong>: Static IP Address<\/li><li><strong>IP Address<\/strong>: Insert the IP of your NordLayer dedicated server<\/li><li><strong>Interface<\/strong>: select your WAN interface<\/li><li><strong>Mode Config<\/strong>: unchecked<\/li><li><strong>NAT Traversal<\/strong>: Disable<\/li><li><strong>Dead Peer Detection<\/strong>: On-Demand<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"authentication-section\">Authentication section:<\/h4>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Method<\/strong>: Pre-shared Key<\/li><li><strong>Pre-shared Key<\/strong>: Insert the generated Shared Key (we will also need this value on our end)<\/li><li><strong>IKE Version<\/strong>: 2<\/li><li><strong>Mode<\/strong>: Main (ID protection)<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"phase-1-proposal-section\">Phase 1 Proposal section:<\/h4>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Encryption<\/strong>: AES256<\/li><li><strong>Authentication<\/strong>: SHA256<\/li><li><strong>Diffie-Hellman Group<\/strong>: <strong>14<\/strong><\/li><li><strong>Key Lifetime (seconds)<\/strong>: 3600<\/li><li><strong>Local ID<\/strong>: leave blank<\/li><li><strong>XAUTH Section<\/strong>: leave disabled<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"phase-2-selectors-advanced-section\">Phase 2 Selectors (+Advanced) section:<\/h4>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Name<\/strong>: NordLayer<\/li><li><strong>Local Address<\/strong>: Your Local network Subnet<\/li><li><strong>Remote Address<\/strong>: 10.6.0.0<\/li><li><strong>Enable Replay Detection<\/strong>: Checked<\/li><li><strong>Enable Perfect Forward Secrecy (PFS)<\/strong>: Checked<\/li><li><strong>Diffie-Hellman Group<\/strong>: <strong>14<\/strong><\/li><li><strong>Encryption<\/strong>: AES256<\/li><li><strong>Authentication<\/strong>: SHA256<\/li><li><strong>Local Port:<\/strong>\u00a0Checked<\/li><li><strong>Remote Port<\/strong>: Checked<\/li><li><strong>Protocol<\/strong>: Checked<\/li><li><strong>Key Lifetime<\/strong>: Seconds<\/li><li><strong>Seconds<\/strong>: 28800<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configuring-firewall-and-static-routing\">Configuring firewall and static routing<\/h3>\n\n\n\n<p>It is necessary to add static routes from the NordLayer subnet (10.6.0.0\/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0\/20) to the local network through the VPN tunnel gateway.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/03%20Setting%20up%20site-to-site%20on%20FortiGate.png\" alt=\"03 Setting up site-to-site on FortiGate.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\"><li>Go to Network -&gt; Routing -&gt; Static Routes -&gt; Create new -&gt; Route<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/04%20Setting%20up%20site-to-site%20on%20FortiGate.png\" alt=\"04 Setting up site-to-site on FortiGate.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\"><li>Set Destination to 10.6.0.0\/20 and the Device: NordLayer (or any other name you chose for the tunnel)<\/li><li>Select OK<\/li><li>It is necessary to add firewall rules to allow traffic from the NordLayer subnet (10.6.0.0\/20) to your local network or services you desire<\/li><li>Go to Policy &amp; Objects -&gt; IPv4 Policy and select Create New<\/li><li>Fill in the following information:<\/li><\/ol>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Name<\/strong>: NordLayer<\/li><li><strong>Incoming Interface<\/strong>: NordLayer<\/li><li><strong>Outgoing Interface<\/strong>: Your local network object<\/li><li><strong>Source<\/strong>: All<\/li><li><strong>Destination<\/strong>: All<\/li><li><strong>Schedule<\/strong>: Always<\/li><li><strong>Service<\/strong>: All<\/li><li><strong>NAT<\/strong>: Disabled<\/li><\/ul>\n\n\n\n<p>If any additional settings appear, leave them in their default status.<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"7\"><li>Select OK<\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"make-sure-the-tunnel-is-up\">Make sure the tunnel is up<\/h3>\n\n\n\n<p>At the FortiGate Management Interface, go to VPN -&gt; IPSec Tunnels. If the tunnel is up the line will appear in the table:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/05%20Setting%20up%20site-to-site%20on%20FortiGate.png\" alt=\"05 Setting up site-to-site on FortiGate.png\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ending-note\">Ending note:<\/h3>\n\n\n\n<p>In order to finalize the site-to-site setup on our end, please provide these values via&nbsp;<a href=\"https:\/\/help.nordlayer.com\/site-to-site\">Site-to-site request from<\/a>&nbsp;in the NordLayer Control Panel:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Pre-shared key &#8211; you can generate it or we can provide it<\/li><li>Encryption\u00a0 details (AES, SHA and DH group) &#8211; AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)<\/li><li>Remote gateway\/router public IP (must be reachable while connected to the dedicated server)<\/li><li>Remote subnet and mask (the subnet is used in your local network)<\/li><\/ul>\n\n\n\n<p>Ref: <a href=\"https:\/\/help.nordlayer.com\/docs\/site-to-site-fortigate\">Setting up site-to-site on FortiGate &#8211; Site-to-site on-premises resources (nordlayer.com)<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Note: If your device\/service supports SHA256 and DH group 14, it is recommended to use these settings instead. Configuring the tunnel at the FortiGate Management Interface Open the FortiGate Management Interface In the left panel, select VPN, then IPsec Tunnels, and select Create New In the VPN Creation Wizard window set the Name to NordLayer <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=4360\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[13,52,9],"tags":[1325,1326],"class_list":["post-4360","post","type-post","status-publish","format-standard","hentry","category-firewalls","category-hardware","category-networks","tag-set-up-site-to-site-vpn-on-fortigate-firewall","tag-site-to-site-vpn-on-fortigate"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4360","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4360"}],"version-history":[{"count":1,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4360\/revisions"}],"predecessor-version":[{"id":4361,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4360\/revisions\/4361"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4360"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4360"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}