Scribd Logo
Upload

Welcome to Scribd!

  • 28 views

    DC1

    Uploaded by

    aripang
    The document configures two IPsec VPN tunnels between spokes using BGP routing. It sets up interfaces, phase1 and phase2 configurations for the tunnels, BGP neighbor groups, address objects, firewall policies and more to enable routing between the spokes via the IPsec tunnels.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    DC1

    Uploaded by

    aripang
    28 views4 pages
    The document configures two IPsec VPN tunnels between spokes using BGP routing. It sets up interfaces, phase1 and phase2 configurations for the tunnels, BGP neighbor groups, address objects, firewall policies and more to enable routing between the spokes via the IPsec tunnels.

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document configures two IPsec VPN tunnels between spokes using BGP routing. It sets up interfaces, phase1 and phase2 configurations for the tunnels, BGP neighbor groups, address objects, firewall policies and more to enable routing between the spokes via the IPsec tunnels.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    28 views4 pages

    DC1

    Uploaded by

    aripang
    The document configures two IPsec VPN tunnels between spokes using BGP routing. It sets up interfaces, phase1 and phase2 configurations for the tunnels, BGP neighbor groups, address objects, firewall policies and more to enable routing between the spokes via the IPsec tunnels.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    of 4

    config system settings

    set tcp-session-without-syn enable


    end
    config vpn ipsec phase1-interface
    edit "inet-111"
    set type dynamic
    set interface "port1"
    set ike-version 2
    set peertype any
    set net-device disable
    set mode-cfg enable
    set proposal aes256-sha256
    set add-route disable
    set dpd on-idle
    set auto-discovery-sender enable
    set network-overlay enable
    set network-id 1
    set tunnel-search nexthop
    set ipv4-start-ip 10.255.1.10
    set ipv4-end-ip 10.255.1.253
    set ipv4-netmask 255.255.255.0
    set psksecret fortinet
    set dpd-retryinterval 60
    next
    edit "mpls-121"
    set type dynamic
    set interface "port2"
    set ike-version 2
    set peertype any
    set net-device disable
    set mode-cfg enable
    set proposal aes256-sha256
    set add-route disable
    set dpd on-idle
    set auto-discovery-sender enable
    set network-overlay enable
    set network-id 5
    set tunnel-search nexthop
    set ipv4-start-ip 10.255.5.10
    set ipv4-end-ip 10.255.5.253
    set ipv4-netmask 255.255.255.0
    set psksecret fortinet
    set dpd-retryinterval 60
    next
    end
    config vpn ipsec phase2-interface
    edit "inet-111_p2"
    set phase1name "inet-111"
    set proposal aes256-sha256 aes256gcm
    set keepalive enable
    set keylifeseconds 1800
    next
    edit "mpls-121_p2"
    set phase1name "mpls-121"
    set proposal aes256-sha256 aes256gcm
    set keepalive enable
    set keylifeseconds 1800
    next
    end
    config system interface
    edit "VPNLoop"
    set vdom "root"
    set type loopback
    set allowaccess ping
    set ip 10.255.127.254 255.255.255.255
    next
    edit "inet-111"
    set vdom "root"
    set ip 10.255.1.254 255.255.255.255
    set allowaccess ping
    set type tunnel
    set remote-ip 10.255.1.10 255.255.255.0
    set interface "port1"
    next
    edit "mpls-121"
    set vdom "root"
    set ip 10.255.5.254 255.255.255.255
    set allowaccess ping
    set type tunnel
    set remote-ip 10.255.5.10 255.255.255.0
    set interface "port2"
    next
    end
    config router bgp
    set as 65001
    set ibgp-multipath enable
    set additional-path enable
    set additional-path-select 4
    config neighbor-group
    edit "inet-111"
    set advertisement-interval 1
    set link-down-failover enable
    set next-hop-self enable
    set soft-reconfiguration enable
    set interface "inet-111"
    set remote-as 65001
    set update-source "inet-111"
    set additional-path send
    set adv-additional-path 4
    set route-reflector-client enable
    next
    edit "mpls-121"
    set advertisement-interval 1
    set link-down-failover enable
    set next-hop-self enable
    set soft-reconfiguration enable
    set interface "mpls-121"
    set remote-as 65001
    set update-source "mpls-121"
    set additional-path send
    set adv-additional-path 4
    set route-reflector-client enable
    next
    end
    config neighbor-range
    edit 0
    set prefix 10.255.1.0 255.255.255.0
    set neighbor-group "inet-111"
    next
    edit 0
    set prefix 10.255.5.0 255.255.255.0
    set neighbor-group "mpls-121"
    next
    end
    config network
    edit 0
    set prefix 10.1.0.0 255.255.255.0
    next
    end
    end
    config firewall address
    edit "RFC_1918_10"
    set subnet 10.0.0.0 255.0.0.0
    next
    edit "RFC_1918_172_16"
    set subnet 172.16.0.0 255.240.0.0
    next
    edit "RFC_1918_192_168"
    set subnet 192.168.0.0 255.255.0.0
    next
    edit "Hub-HC"
    set subnet 10.255.127.254 255.255.255.255
    next
    end
    config firewall addrgrp
    edit "RFC_1918_ALL"
    set member "RFC_1918_10" "RFC_1918_172_16" "RFC_1918_192_168"
    next
    end
    config router policy
    edit 0
    set input-device "inet-111"
    set output-device "inet-111"
    next
    edit 0
    set input-device "mpls-121"
    set output-device "mpls-121"
    next
    end
    ## Firewall policy is require for VPN to stand up - please lockdown these policies
    as appropriate
    config firewall policy
    edit 0
    set name "ADVPN Spoke to Spoke"
    set srcintf "inet-111" "mpls-121"
    set dstintf "inet-111" "mpls-121"
    set srcaddr "RFC_1918_ALL"
    set dstaddr "RFC_1918_ALL"
    set action accept
    set schedule "always"
    set service "ALL"
    set anti-replay disable
    set tcp-session-without-syn all
    set logtraffic disable
    next
    edit 0
    set name "ADVPN Out"
    set srcintf "any"
    set dstintf "inet-111" "mpls-121"
    set srcaddr "RFC_1918_ALL"
    set dstaddr "RFC_1918_ALL"
    set action accept
    set schedule "always"
    set service "ALL"
    set logtraffic disable
    next
    edit 0
    set name "ADVPN In"
    set srcintf "inet-111" "mpls-121"
    set dstintf "any"
    set srcaddr "RFC_1918_ALL"
    set dstaddr "RFC_1918_ALL"
    set action accept
    set schedule "always"
    set service "ALL"
    set logtraffic disable
    next
    edit 0
    set name "ADVPN Hub HC"
    set srcintf "inet-111" "mpls-121"
    set dstintf "VPNLoop"
    set srcaddr "all"
    set dstaddr "Hub-HC"
    set action accept
    set schedule "always"
    set service "ALL"
    set logtraffic disable
    next
    end

    You might also like