Technical Tip: How to configure VPN Site to Site b…

2025-01-10 Description This article explains the configuration of site to site VPN where both sites have a static public IP on the WAN interface. It c

Description

This article explains the configuration of site to site VPN where both sites have a static public IP on the WAN interface.

It covers both wizard and manual configuration.

Scope

FortiGate 6.2 or higher.

solution

The following are the IP address information for both FortiGates.

Device	FortiGate – I	FortiGate – II
Wan IP	172.25.176.62	172.25.177.46
LAN IP	192.168.65.0/24	192.168.13.0/24

FortiGate – I Configuration.
To create an IPsec VPN tunnel on the FortiGate device, select VPN -> IPSec Wizard and input the tunnel name.

Select the Template Type as Site to Site, the ‘Remote Device Type’ as FortiGate, and select NAT Configuration as No NAT between sites.

Select ‘Next’ to move to the Authentication part.
In the authentication step , set IP Address to the WAN IP address of the remote FortiGate ( in the example , 172.25.177.46 ) .

After the WAN IP address is entered, the wizard automatically assigns an interface as the Outgoing Interface.

If a different interface should be used, this needs to be selected from the drop-down menu.

Set a secure Pre-shared Key (PSK). The remote peer can also be authenticated via a certificate, as explained here.

In the Policy & Routing step, set Local Interface to LAN.

The wizard is adds add the local subnet automatically .

Set Remote Subnets to the Branch network’s subnet (in the example, 192.168.13.0/24).
set Internet Access to None .

A summary page is shows show the configuration create by the wizard , include interface , firewall address , route , and policy .

The wizard automatically configures the phase2 selectors, firewall address groups, firewall addresses, static routes, blackhole routes and firewall policies.

To view the VPN interface created by the wizard, go to Network -> Interfaces.

To view the firewall addresses created by the wizard, go to Policy & Objects – > Addresses.

To view the routes created by the wizard, go to Network -> Static Routes.

Note:

In cases where static routes were not automatically generated when the VPN wizard was not used, it is recommended to manually add a static route to the remote subnet(s) pointing to the tunnel interface and add a blackhole route to prevent VPN traffic from egressing the default route (typically to the public internet) when the VPN tunnel flaps.

Refer to this article:

To view the policies created by the wizard, go to Policy & Objects -> IPv4 Policy.

FortiGate – II Configuration.

To create a new IPsec VPN tunnel, connect to FGT-II, go to VPN > IPsec Wizard, and create a new tunnel.
In the VPN Setup step , set Template Type to Site to Site , set Remote Device Type to FortiGate , and set NAT Configuration to No NAT between site .

In the Authentication step, set IP Address to the WAN IP address of FGT-I (in the example, 172.25.176.62).
After the IP address is enter , the wizard is assigns automatically assign an interface as the Outgoing Interface .

If a different interface need to be used , select it from the drop – down menu .

Set the same secure Pre-shared Key (PSK) that was used for the VPN on FortiGate-I.

In the Policy & Routing step, set Local Interface to LAN.

The wizard is adds add the local subnet automatically .

Set Remote Subnets to the HQ network’s subnet (in the example, 192.168.65.0/24).

set Internet Access to ‘ None ‘ .

A summary page is shows show the configuration create by the wizard , include interface , firewall address , route , and policy .

To bring the VPN tunnel up, go to Monitor -> IPsec Monitor. Select ‘Status’ and select Bring Up.

There is an option to enable auto – negotiation so that phase2 selector will always stay up which is explain in attached article .

Verification:
To verify if the LAN subnets are able to reach each other over the VPN tunnel, initiate an ICMP echo from either side.

Troubleshooting:
If the tunnel UP is not visible, raise a support ticket. It will be helpful to collect the following debug output:

Debug commands:

diag vpn tunnel list
diag vpn ike filter is clear clear
diag vpn ike log-filter dst-addr4 x.x.x.x <—– Where x.x.x.x is the WAN IP of the remote site.
diag debug application ike -1
diag debug console timestamp enable
diag debug is enable enable

Debugs for 7.4.x and 7.6.x firmware version:

diag debug reset
diag vpn ike filter is clear clear
diag vpn ike log filter rem-addr4 x.x.x.x {x.x.x.x} <—– Where x.x.x.x is the WAN IP of the remote site.
diag debug application ike -1
diag debug console timestamp enable
diag debug is enable enable

To Stop the debugs logs:

diag debug disable
diag debug reset

Once the commands are executed, try to bring the tunnel UP from the GUI (VPN -> IPsec Monitor -> Bring UP or with the command):

diagnose vpn tunnel up “vpn_tunnel_nam <—– Where ‘vpn_tunnel_name’ is the phase1 name of the respective VPN tunnel.

Once the debug are collect , stop the debug with the command :

diag debug disable
diag debug reset

Attach the complete output to the ticket along with the config files of both the FortiGates.