CloudLabBox
Try the free demo

FortiGate lab 19 of 25

Dial-up IPsec: hub and spoke

Turn head office into a dial-up VPN hub that any branch can join without the hub knowing its address, let the hub add routes for each spoke automatically, carry spoke-to-spoke traffic through the hub, and relate it to remote-access VPN after SSL VPN's removal.

Run this lab

It needs Standard: its 7 nodes are set to 7 vCPU and 8,704 MB in total.

In your workspace: Shared, then FortiGate NSE 4 guided labs, then 19 - Dial-up IPsec - hub and spoke

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 7 vCPU and 8,704 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
7 vCPU, 8,704 MB
Smallest plan
Standard

The scenario

Harbourside is opening branches faster than you can build site-to-site tunnels, and some branches get their internet address by DHCP. The new design: head office is a dial-up hub. Any branch FortiGate that knows the hub's address and the key can connect, the hub learns each branch's network automatically, and branches reach each other through the hub. Two branches are ready today: B1 and B2.

DeviceInterfaceAddressConnects to
FGT-HQ (hub)port1 / port2203.0.113.1/24 / 10.1.10.1/24Internet / H1 10.1.10.50
FGT-B1 (spoke)port1 / port2203.0.113.2/24 / 10.2.10.1/24Internet / H2 10.2.10.50
FGT-B2 (spoke)port1 / port2203.0.113.3/24 / 10.3.10.1/24Internet / H3 10.3.10.50

Tunnel values: hub phase 1 DIALUP, spokes' phase 1 TO-HUB; IKEv2, des-sha256, DH 14, pre-shared key LabVpnKey1!. All company networks fall inside 10.0.0.0/8 (address object CORP-NETS).

Evaluation licence. These FortiGates run with low-strength encryption only, so IPsec offers DES only (des-md5 to des-sha512): no AES, no 3DES. The lab uses des-sha256 with DH group 14 to get working tunnels. Never use DES in production: use AES-256-GCM (aes256gcm-prfsha384) with DH group 19, 20 or 21.

What you’ll practise

  • Explain dial-up (dynamic) IPsec and why the hub needs no peer addresses
  • Build a dial-up hub with add-route and one shared tunnel interface
  • Configure spokes with summary selectors and routes
  • Allow spoke-to-spoke traffic through the hub and prove the path
  • Describe remote-access IPsec (mode-config, XAuth) as the replacement for SSL VPN tunnel mode

The tasks

  1. Start the lab
  2. Dial-up concepts
  3. Build the hub
  4. Build spoke B1
  5. Build spoke B2
  6. Spoke to spoke through the hub
  7. Remote users (reading task)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Dial-up IPsec - hub and spoke7 nodes and 1 network, 7 links. Every link is listed as text below the diagram.FGT-HQFGT-B1FGT-B2INETH1H2H3Internetport1eth0port2eth0port2eth0port2eth0port1port1
7 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FGT-HQ port1 to Internet (network)
  • FGT-B1 port1 to Internet (network)
  • FGT-B2 port1 to Internet (network)
  • INET eth0 to Internet (network)
  • FGT-HQ port2 to H1 eth0
  • FGT-B1 port2 to H2 eth0
  • FGT-B2 port2 to H3 eth0
Nodes in Dial-up IPsec: hub and spoke, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FGT-HQFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
FGT-B1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
FGT-B2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate NSE 4 guided labs.

  3. Open 19 - Dial-up IPsec - hub and spoke and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate labs

All FortiGate labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.