Tag Archives

2 Articles

Network

Setting up IPSec VPN between Fortigate and Axsguard

Posted by Maarten Van Driessen on

If you’ve ever had the “pleasure” of building an IPSec tunnel between 2 endpoints from different vendors, you’ll know how smooth that usually goes. Today I was building a tunnel between a Fortigate 70D and an Axsguard Gatekeeper, as you can guess, things didn’t go as planned.

Fortigate

Let’s start by creating the tunnel on the Fortigate. Create a new tunnel and select the Custom VPN Tunnel template.

FG-tunnel1

 

Next, fill in all the phase 1 settings. In this example, I’m using 3DES and SHA1. While 3DES is still considered as secure, I would recommend against using it in production, mainly because of the speed. If you want to use the public IP address as the local ID, leave the field empty. Fortigate will automatically send its public IP as the local ID. Keep this in mind when you’re behind a NAT device.

FG-phase1

In the phase 2 settings, you can specify what addresses should be configured on the tunnel. You can choose between a subnet, IP range or a single IP address.

FG-phase2

 

You will still need to configure a route and firewall rules for VPN traffic.

Axsguard

The same principles apply to the configuration of the Axsguard.  One thing to pay attention to is the key lifetime, Fortinet uses seconds to express the lifetime on its devices. Axsguard, on the other hand, uses minutes for the lifetime.

Let’s go ahead and create a new tunnel on the Axsguard. Fill in the local parameters. If you can’t find the settings that correspond to the settings on the Fortigate, you can add them in the IPSec -IKE, and IPSec – ESP menus. Make sure to set the settings exactly the same as on the Fortigate.

Axsguard local parameters

 

Same goes for the remote parameters.

Axsguard remote parameters

 

The Axsguard will automatically create the required firewall rules to allow traffic to pass through the tunnel.

Facebooktwittergoogle_plusredditlinkedinFacebooktwittergoogle_plusredditlinkedin
Network

Using VLANs on Fortigate 30D

Posted by Maarten Van Driessen on

While setting up a new Fortigate 30D for a client, I wanted to add a new VLAN for the guest Wi-Fi network. Usually, you just go into NetworkInterfaces and add a new Interface there.

On the 30D however, this option wasn’t there. After changing the device from switch mode to interface mode and back, I figured you can’t do it in the GUI. The only way to do it on a 30D is by using the CLI.

To add a new VLAN, go to the dashboard, open up the CLI and enter these commands:

After running these commands, you’ll also see the VLAN show up in the Network – Interfaces page.

Facebooktwittergoogle_plusredditlinkedinFacebooktwittergoogle_plusredditlinkedin