CloudLabBox
Try the free demo

FortiGate lab 17 of 25

Site-to-site IPsec VPN

Join head office and the new branch with a route-based IKEv2 tunnel: phase 1 and phase 2, routes with a blackhole safety net, policies in both directions, then read the tunnel's state and find a pre-shared key mismatch with IKE debug.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 7,680 MB in total. That fits the free demo too.

In your workspace: Shared, then FortiGate NSE 4 guided labs, then 17 - Site-to-site IPsec VPN

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
5 vCPU, 7,680 MB
Smallest plan
Lite

The scenario

Harbourside has opened a branch in Cardiff with its own FortiGate (FGT-BR) on the same ISP. Branch staff need the HQ file servers and HQ staff need the branch printers, privately and without opening anything to the internet. You build a route-based IPsec tunnel between the two FortiGates and prove traffic flows both ways.

DeviceInterfaceAddressConnects to
FGT-HQport1 (ISP-A)203.0.113.1/24Internet (gateway 203.0.113.254)
FGT-HQport2 (LAN)10.1.10.1/24PC1 10.1.10.10
FGT-BRport1 (ISP-A)203.0.113.2/24Internet (gateway 203.0.113.254)
FGT-BRport2 (LAN)10.2.10.1/24H2 10.2.10.50 (DHCP reservation)

Tunnel parameters (both sides): IKEv2, pre-shared key LabVpnKey1!, proposal des-sha256, DH group 14, phase 2 selectors HQ 10.1.10.0/24 ↔ branch 10.2.10.0/24.

Evaluation licence. These FortiGates run with low-strength encryption only, so IPsec offers DES only (des-md5 to des-sha512): no AES, no 3DES, not even NULL. The lab uses des-sha256 to get a working tunnel. Never use DES in production: use AES-256-GCM (aes256gcm-prfsha384) with DH group 19, 20 or 21.

What you’ll practise

  • Explain IKE phase 1 and phase 2, IKEv1 and IKEv2, selectors, PFS and DPD
  • Build a route-based IPsec tunnel between two FortiGates from the CLI
  • Route traffic into the tunnel, with a blackhole route so it never leaks
  • Allow traffic in both directions with firewall policies
  • Check the tunnel with summary, gateway and tunnel lists, and debug IKE
  • Describe what the IPsec wizard creates for you

The tasks

  1. Start the lab
  2. Phase 1 on both FortiGates
  3. Phase 2 with selectors
  4. Routes and a blackhole safety net
  5. Policies in both directions
  6. Break it and debug IKE
  7. What the wizard does (GUI)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Site-to-site IPsec VPN5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.FGT-HQFGT-BRINETPC1H2Interneteth0port1port1port2eth0port2eth0
5 nodes and 1 network, with the interface names each link uses.
Every link, as text
  • FGT-HQ port1 to Internet (network)
  • FGT-BR port1 to Internet (network)
  • INET eth0 to Internet (network)
  • FGT-HQ port2 to PC1 eth0
  • FGT-BR port2 to H2 eth0
Nodes in Site-to-site IPsec VPN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FGT-HQFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
FGT-BRFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 2,048 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate NSE 4 guided labs.

  3. Open 17 - Site-to-site IPsec VPN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate labs

All FortiGate labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.