CloudLabBox
Try the free demo

Firewalls and VPNs lab 4 of 16

FortiGate to IOS - phase 1 and 2 through carrier-grade NAT

Connect a FortiGate head office to an IOS branch router that sits behind the ISP's carrier-grade NAT. Match phase 1 and phase 2 across the two vendors, watch NAT traversal move IKE and ESP to UDP 4500, and see honestly why this evaluation FortiGate can only offer DES.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,840 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 04 - FortiGate to IOS - phase 1 and 2 through carrier-grade NAT

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 80 minutes
Nodes need
5 vCPU, 3,840 MB
Smallest plan
Lite

The scenario

Meridian Print has a FortiGate at head office. Its new branch in a retail park only got a cheap business line, and the ISP puts it behind carrier-grade NAT (CGNAT): the branch router's WAN address is 100.64.0.2, from the shared address space, and the ISP translates it to the public address 198.51.100.77 on the way out. The branch router is a Cisco IOS router. Connect the branch LAN to HQ with IKEv2.

DeviceInterfaceAddressNotes
FGT-HQport1 / port2203.0.113.2/24 / 10.1.10.1/24Default route to 203.0.113.1; policy 1 is LAN-to-Internet with NAT
HQ-PCGi0/010.1.10.10/24Gateway 10.1.10.1
ISPether1 / ether2203.0.113.1/24 / 100.64.0.1/30CGNAT: 100.64.0.0/30 leaves as 198.51.100.77
BRANCHGi0/0 / Gi0/1100.64.0.2/30 / 10.2.10.1/24Default route to 100.64.0.1
BR-PCGi0/010.2.10.10/24Gateway 10.2.10.1
TunnelFGT-HQ to-BRANCH / BRANCH Tunnel1169.254.40.1 / 169.254.40.2Link addresses for testing
SettingThis labIn production
Phase 1 (IKE SA)IKEv2, DES with SHA-256, DH group 14IKEv2, AES-256-GCM (PRF SHA-384), DH group 19, 20 or 21
AuthenticationPre-shared key Meridian-VPN-27A long random key, or certificates (lab 09)
Phase 2 (IPsec SA)ESP DES with SHA-256, PFS group 14ESP AES-256-GCM, PFS group 19, 20 or 21
Selectors0.0.0.0/0 both ways (route-based on both ends)The same

Why DES here? This FortiGate runs on its built-in evaluation licence, which only allows "low encryption": no HTTPS administration, and DES as the only IPsec cipher. DES has a 56-bit key and was broken by brute force in the late 1990s, so never use it on a real network. Everything else you build here (the objects, the order of the work, NAT traversal, the checks) is exactly what you would do with AES-GCM on a licensed unit, and the IOS side would simply change its proposal.

What you’ll practise

  • Translate a crypto standard into FortiGate phase1-interface and phase2-interface settings and IOS IKEv2 objects
  • Match a FortiGate route-based tunnel with an IOS static VTI (0.0.0.0/0 selectors)
  • Route into the tunnel on FortiGate, with a blackhole route as a safety net, and write the firewall policies
  • Explain NAT traversal: NAT detection, the move to UDP 4500, ESP in UDP and keepalives
  • Verify with get vpn ipsec tunnel summary, diagnose vpn ike gateway list, show crypto ikev2 sa and show crypto ipsec sa
  • State the evaluation licence's DES limit and the production choice

The tasks

  1. Look at the path
  2. Phase 1 and phase 2 on FGT-HQ
  3. Routes and policies on FGT-HQ
  4. The IOS branch
  5. Verify, and find NAT traversal in the output

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of FortiGate to IOS - phase 1 and 2 through carrier-grade NAT5 nodes, 4 links. Every link is listed as text below the diagram.FGT-HQHQ-PCISPBRANCHBR-PCport2Gi0/0Gi0/1Gi0/0port1ether1ether2Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FGT-HQ port2 to HQ-PC Gi0/0
  • FGT-HQ port1 to ISP ether1
  • ISP ether2 to BRANCH Gi0/0
  • BRANCH Gi0/1 to BR-PC Gi0/0
Nodes in FortiGate to IOS - phase 1 and 2 through carrier-grade NAT, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FGT-HQFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
HQ-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
BRANCHCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BR-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 04 - FortiGate to IOS - phase 1 and 2 through carrier-grade NAT and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.