Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 16 views

    Establish IPSec VPN Between Hillstone and FortiGate Firewalls

    Uploaded by

    Bernard Francis Surita Placencia
    3

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Establish IPSec VPN Between Hillstone and FortiGate Firewalls

    Uploaded by

    Bernard Francis Surita Placencia
    16 views6 pages
    3

    Original Title

    Establish-IPSec-VPN-between-Hillstone-and-FortiGate-firewalls

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    3

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    16 views6 pages

    Establish IPSec VPN Between Hillstone and FortiGate Firewalls

    Uploaded by

    Bernard Francis Surita Placencia
    3

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 6

    Establish IPSec VPN between Hillstone and FortiGate firewalls

    Hillstone Networks
    Topology

    Basic Network Configuration


    FortiGate
    1. Interface Configuration
    config system interface
    edit "wan1"
    set vdom "root"
    set ip 222.90.x.x 255.255.255.252
    set allowaccess ping https ssh http
    set type physical
    set alias "dianxin"
    next
    edit "internal"
    set vdom "root"
    set ip 192.168.x.x 255.255.255.0
    set allowaccess ping https ssh http telnet
    set type physical
    set alias "neiwang"
    next
    end
    2. Routing configuration
    config router static
    edit 1
    set device "wan1"
    set gateway 222.90.x.x
    next
    edit 2
    set device "internal"
    set dst 192.168.0.0 255.255.0.0
    set gateway 192.168.x.x
    next
    end
    3. Policy and SNAT Configuration
    config firewall policy
    edit 5
    set srcintf "internal"
    set dstintf "wan1"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set utm-status enable
    set schedule "always"
    set service "ANY"
    set application-list "block-p2pmediagame"
    set nat enable
    next
    end
    Hillstone
    1. Interface Configuration
    interface ethernet0/1
    zone "untrust"
    ip address 1.85.x.x 255.255.255.224
    manage ping
    no reverse-route
    exit
    interface ethernet0/2
    zone "trust"
    ip address 172.16.253.1 255.255.255.0
    manage ping
    no reverse-route
    exit
    2. SNAT Configuration
    snatrule id 1 from "Any" to "Any" service "Any" eif ethernet0/1
    trans-to eif-ip
    mode dynamicport sticky
    Routing Configuration
    ip route 0.0.0.0/0 1.85.x.x
    3. Policy Rule Configuration
    rule id 1
    action permit
    src-zone "trust"
    dst-zone "untrust"
    src-addr "Any"
    dst-addr "Any"
    service "Any"
    exit
    IPSec VPN Configuration
    FortiGate
    1. Phase 1
    config vpn ipsec phase1
    edit "haorui"
    set interface "wan1"
    set dhgrp 2
    set proposal des-md5 aes128-sha1
    set keylife 86400
    set localid "vpn.shenguang.com"
    set remote-gw 1.85.x.x
    set psksecret ENC
    ZlnbB/6u3xiLfN5ra99YUO+D4TF9ndeGs8P0JbHCD8GL/qEmwkuJGyeS+7Wt4kNX2
    kwXqEuba+lC9K9hN+R2F6/Rs08sBjA4oT/hH6vWFEK/EYey
    next
    end
    2. Phase 2
    config vpn ipsec phase2
    edit "haorui"
    set phase1name "haorui"
    set proposal des-sha1 aes128-sha1
    set dhgrp 2
    set dst-subnet 172.16.0.0 255.255.0.0
    set src-subnet 192.168.0.0 255.255.0.0
    next
    end
    3. Naming the tunnel
    config vpn ipsec concentrator
    edit "ipsec"
    set member "haorui"
    next
    end
    4. Policy Rule for IPSec VPN
    config firewall policy
    edit 6
    set srcintf "internal"
    set dstintf "wan1"
    set srcaddr "192.168.0.0/16"
    set dstaddr "172.16.0.0/16"
    set action ipsec
    set schedule "always"
    set service "ANY"
    set inbound enable
    set outbound enable
    set vpntunnel "haorui"
    next
    end
    5. Routing for IPSec VPN
    config router static
    edit 3
    set device "wan1"
    set dst 172.16.0.0 255.255.0.0
    set gateway 172.16.0.253
    next
    end
    Hillstone
    1. Phase 1
    isakmp proposal "psk-md5-des-g2"
    hash md5
    encryption des
    exit
    isakmp peer "haorui1"
    isakmp-proposal "psk-md5-des-g2"
    pre-share "6FpWj0A/PZJ4v06Vb1pfgrdJA2YM4CCj6s4F3/0nPpol5F0yaw"
    peer 222.90.x.x
    peer-id fqdn wildcard "vpn.shenguang.com"
    nat-traversal
    dpd interval 10 retry 3
    interface ethernet0/1
    exit
    2. Phase 2
    ipsec proposal "esp-md5-des-g2"
    hash md5
    encryption des
    group 2
    exit
    ipsec proposal "p2"
    hash sha
    encryption des
    group 2
    exit
    tunnel ipsec "haorui1" auto
    isakmp-peer "haorui1"
    ipsec-proposal "p2"
    id local 172.16.0.0/16 remote 192.168.0.0/16 service "Any"
    responder-set-commit
    auto-connect
    exit
    3. Tunnel Interface
    interface tunnel1
    zone "VPNHub"
    ip address dhcp
    tunnel ipsec "haorui1"
    no reverse-route
    exit
    4. Policy Rule for IPSec VPN
    rule id 4
    action permit
    src-zone "VPNHub"
    src-addr "Any"
    dst-addr "Any"
    service "Any"
    exit
    5. Routing for IPSec VPN
    ip route 192.168.0.0/16 tunnel1

    You might also like