FortinetConfig756 downloads

Fortinet FortiGate Site-to-Site IPSec VPN

IKEv2 site-to-site IPSec VPN for FortiGate: phase1/phase2 proposals, tunnel interface, static route, and firewall policy for VPN traffic.

↓ example.txt

What is it?

FortiGate IPSec VPN uses a two-phase configuration: Phase 1 (phase1-interface) negotiates the IKE security association — authentication and key exchange. Phase 2 (phase2-interface) negotiates the data tunnel parameters (encryption, hashing, PFS). Unlike Palo Alto which requires a separate tunnel interface object, FortiGate creates the tunnel interface automatically from the phase1-interface configuration and names it the same as the tunnel. Firewall policies are then required in both directions (inbound and outbound) to allow traffic through the tunnel.

When to use

·Site-to-site connectivity to branch offices, data centers, or cloud providers
·Connecting to third-party VPN gateways (Cisco ASA, Palo Alto, AWS VPN Gateway)
·Hub-and-spoke VPN topology with a central FortiGate as hub
·Dial-up VPN for dynamic-IP remote sites (remote FortiGate or compatible device)

When NOT to use

·Remote user access — use FortiClient SSL VPN (port 443) or IPSec with FortiClient for better UX
·When both sites are FortiGates — consider ADVPN (Auto Discovery VPN) or SD-WAN overlay for automatic spoke-to-spoke tunnels

How it compares

vs Palo Alto IPSec VPNPalo Alto requires manually creating tunnel interface + zone + route. FortiGate creates the tunnel interface automatically. Both require proxy IDs (FortiGate: src-subnet/dst-subnet in phase2) when connecting to policy-based peers.

vs Cisco IOS IPSec (crypto map)IOS crypto maps are applied to physical interfaces. FortiGate phase1-interface creates a dedicated tunnel interface — cleaner routing. Both support IKEv1 and IKEv2.

Prerequisites

→WAN interface must be configured with the public IP before referencing in phase1
→Phase 1 and Phase 2 proposals must match exactly with the remote peer
→Static route to the remote subnet via the tunnel interface must be added
→Two firewall policies needed: inbound (tunnel → internal) and outbound (internal → tunnel)

Config Generator

Hostname *

Tunnel Name *

WAN Interface *

Remote Peer IP *

Pre-Shared Key *

IKE Version

Phase1 Encryption

Phase1 Auth

Phase1 DH Group

Phase2 Encryption

Phase2 Auth

Phase2 PFS Group

Local Subnet *

Remote Subnet *

Tunnel Local IP

Tunnel Remote IP

Enable DPD?

Verification commands

get vpn ipsec tunnel summary

Show all IPSec tunnels and their status (up/down, bytes in/out)

ExpectedTunnel shows 'up' with non-zero bytes. 'down' means Phase 1 or Phase 2 failed.

diagnose vpn ike status summary

Show IKE Phase 1 SA status for all gateways

ExpectedShows established SAs with peer IP, IKE version, and lifetime. Empty means Phase 1 not establishing.

diagnose vpn tunnel list

Show detailed IPSec Phase 2 tunnel info including selectors

ExpectedShows src/dst selectors (proxy IDs), encryption suite, and bytes counters per tunnel

Debug commands

diagnose debug application ike -1

Enable IKE debug logging for Phase 1 troubleshooting

WarningUse with caution in production. Disable after: 'diagnose debug application ike 0; diagnose debug reset'

Common mistakes & fixes

SymptomTunnel not establishing — stays down

CauseUDP 500/4500 blocked on WAN interface, pre-shared key mismatch, or IKE proposal mismatch

FixVerify 'get system interface <wan>' has no policy blocking IKE. Check PSK matches. Run IKE debug to see exact failure reason.

SymptomPhase 1 up but Phase 2 not establishing

CauseProxy ID (src/dst subnet) mismatch with remote peer

FixVerify phase2 src-subnet and dst-subnet exactly match the remote peer's configured selectors. For IKEv2 route-based VPNs, set to 0.0.0.0/0 on both sides.

SymptomTunnel up but traffic not passing in one direction

CauseMissing firewall policy for that traffic direction, or route missing

FixFortiGate requires explicit policies in BOTH directions. Verify both 'VPN-tunnel-in' and 'VPN-tunnel-out' policies exist. Check static route to remote subnet exists.

Further learning

Recommended books to go deeper on this topic.

Palo Alto Networks Firewall Deployment and Administration

Tom Piens · Packt · IPsec VPN on PAN-OS — IKEv1/v2, GlobalProtect, tunnel configuration

Kindle ↗Hardcover ↗Paperback ↗

Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services

Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · IKE phase 1 & 2 deep dive — concepts apply to all vendors

Kindle ↗Hardcover ↗