VPN Configuration
Core concepts
FortiGate supports IPsec site-to-site and dial-up, plus SSL VPN. For IPsec, know phase 1 (IKE: authentication, encryption, DH group, peer, mode) and phase 2 (IPsec SA: selectors, PFS, lifetime). Mismatched proposals between peers are the most common failure. For dial-up, the hub uses a dynamic peer and the spokes initiate. Route-based VPNs use tunnel interfaces; policy-based VPNs use selectors in policies.
SSL VPN
SSL VPN provides client-mode (full tunnel) or web-mode (portal bookmarks) access. Traps include forgetting firewall policies for the SSL VPN tunnel interface, or misconfiguring the portal to expose resources. Authentication for SSL VPN uses user groups, so identity configuration overlaps with the Authentication domain.
Traps to watch
- Phase 1/phase 2 proposal mismatches (encryption, hash, DH group, PFS).
- Pre-shared key mismatch or wrong peer ID/remote gateway.
- Missing or misordered policies on the tunnel interface-VPN comes up but traffic does not pass.
- Overlapping local/remote subnets break routing; NAT may be needed.
- For route-based VPNs, the tunnel interface must be in the routing table or policy route.
Worked example
A site-to-site tunnel shows phase 1 up but phase 2 down. Phase 1 up means IKE negotiation succeeded (PSK, proposals, peer identity). Phase 2 down points to selector mismatch (local/remote subnet definitions) or PFS/DH mismatch in phase 2. Rule of thumb: phase 1 up + phase 2 down = phase 2 parameters or selectors; both down = phase 1 parameters or reachability.