68
edits
Changes
Default IPsec route configuration between Teltonika and Fortigate devices (view source)
Revision as of 12:21, 19 June 2024
, 19 Juneno edit summary
==Topology==
==Topology==
'''Fortinet''' – The '''Fortinet''' will act as a "default gateway" for the RUT device. '''Fortinet''' has a LAN subnet of 192.168.5.0/24 and WAN subnet of 192.168.10.2/24 configured on it, which should be reachable by the spoke.
'''Fortinet''' – The Fortinet will act as a '''hub'''. A hub is a server, to which our spoke will be connected (IPsec responder). It will be our "default gateway" for the spoke device. Fortinet has a LAN subnet of 192.168.5.0/24 and WAN subnet of 192.168.10.2/24 configured on it, which should be reachable by the spoke.
'''RUT''' – The '''RUTX11''' in this case will be connected to '''Fortinet''' for basic internet access. '''RUT''' has a LAN subnet of 192.168.1.0/24 and WAN subnet of 192.168.10.1/24 configured on it.
==Fortinet (Hub) configuration==
==Fortinet (Hub) configuration==
[[File:Fortigate_IPsec_Phase2_Proposal_Configuration.png|border|class=tlt-border|center]]
[[File:Fortigate_IPsec_Phase2_Proposal_Configuration.png|border|class=tlt-border|center]]
===Firewall configuration===
After setting up our IPsec instance, we will need to configure our firewall accordingly. Navigate to '''Policy & Objects → Firewall Policy → and click on a Create new button.'''. Configure everything as follows.
----
Make the following changes:
# Incoming interface - '''''Tunnel interface name (In this case it is Teltonika);'''''
# Outgoing interface - '''''wan2 (choose WAN port from which Fortinet gets internet);'''''
# Source - '''''192.168.1.0/255.255.255.0;'''''
# Destination - '''all;'''
# Service - '''ALL;'''
[[File:Fortinet_Ipsec_Firewall_default_route.png|border|class=tlt-border|center]]
===Static Routes configuration===
After setting up our IPsec instance and firewall, we will need to configure our static route accordingly. Navigate to '''Network → Static routes → and click on a Create new button.'''. For that we will need to create two static routes, one for blackhole and one for accessing our RUT device, configure everything as follows.
----
Make the following changes:
<table class="nd-othertables_2">
<tr>
<th width=330; style="border-bottom: 1px solid white;></th>
<th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Fortinet_IPsec_Add_route_tunnel.png|border|class=tlt-border|center]]</th>
</tr>
<tr>
<td style="border-bottom: 4px solid white>
# Destination - '''''192.168.1.0/255.255.255.0;'''''
# Interface - '''''Tunnel interface name (In this case it is Teltonika);'''''
</td>
</tr>
</table>
----
Then create a new static route for blackhole.
Make the following changes:
<table class="nd-othertables_2">
<tr>
<th width=330; style="border-bottom: 1px solid white;></th>
<th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Fortinet_IPsec_Add_route_blackhole.png|border|class=tlt-border|center]]</th>
</tr>
<tr>
<td style="border-bottom: 4px solid white>
# Destination - '''''192.168.1.0/255.255.255.0;'''''
# Interface - '''''Blackhole;'''''
</td>
</tr>
</table>
==RUT (Spoke) configuration==
==RUT (Spoke) configuration==
Start by configuring the spoke (RUT) device. Login to the WebUI, navigate to '''Services → VPN → IPsec and add a new IPsec instance.''' Configure everything as follows.
Start by configuring the spoke (RUT) device. Login to the WebUI, navigate to '''Services → VPN → IPsec and add a new IPsec instance.''' Configure everything as follows.
[[File:Networking_ssh_manual_IPsec_configuration_IPsec_statusall_test_v1.png|border|class=tlt-border|971x135px|center]]
[[File:Networking_ssh_manual_IPsec_configuration_IPsec_statusall_test_v1.png|border|class=tlt-border|971x135px|center]]
----
----
Also, as the hub should be reachable by spoke, we can try pinging the hub using <code><span class="highlight" >'''ping 192.168.5.99'''</span></code>:
Also, we should be able to access internet routed via Fortigate, we can check it out by pinging 8.8.8.8 and checking what public IP we get by executing this command via command line on RUT device: <code><span class="highlight" >'''curl icanhazip.com'''</span></code> and <code><span class="highlight" >'''ping 8.8.8.8'''</span></code>:
[[File:Networking_ssh_manual_IPsec_configuration_test_ping_v1.png|border|class=tlt-border|506x133px|center]]
[[File:RutIpsecCurlPingTest.png|border|class=tlt-border|506x133px|center]]
----
----
To check if IPsec tunnel is working properly from hub (Fortinet), we can try pinging our spoke (RUT) by using this command in command line interface on Fortinet<code><span class="highlight" >'''exec ping 192.168.1.1'''</span></code>, if you are not able to ping spoke (RUT), try changing the source interface from which we try pinging, by executing this command <code><span class="highlight" >'''exec ping-options source 192.168.5.99'''</span></code>:
To check if IPsec tunnel is working properly from hub (Fortinet), we can try pinging our spoke (RUT) by using this command in command line interface on Fortinet<code><span class="highlight" >'''exec ping 192.168.1.1'''</span></code>, if you are not able to ping spoke (RUT), try changing the source interface from which we try pinging, by executing this command <code><span class="highlight" >'''exec ping-options source 192.168.5.99'''</span></code>:
