Teltonika Networks Wiki

Changes

Default IPsec route configuration between Teltonika and Fortigate devices (view source)

Revision as of 12:21, 19 June 2024

2,808 bytes added ,  19 June
no edit summary
Line 8: Line 8:  
'''Prerequisites:'''
 
'''Prerequisites:'''
   −
* One RUT/RUTX series router with RUTOS firmware;
+
* One RUT/RUTX series router or TRB gateway with RUTOS firmware;
−
* One Fortigate series router;
+
* One Fortinet series router;
 
* An end device (PC, Laptop) for configuration;
 
* An end device (PC, Laptop) for configuration;
   Line 16: Line 16:     
==Topology==
 
==Topology==
 +
'''Fortinet''' – The '''Fortinet''' will act as a "default gateway" for the RUT device. '''Fortinet''' has a LAN subnet of 192.168.5.0/24 and WAN subnet of 192.168.10.2/24 configured on it, which should be reachable by the spoke.
   −
'''Fortigate''' – The Fortigate will act as a '''hub'''. A hub is a server, to which our spoke will be connected (IPsec responder). It will be our "default gateway" for the spoke device. Fortigate has a LAN subnet of 192.168.5.0/24 and WAN subnet of 192.168.10.2/24 configured on it, which should be reachable by the spoke.
+
'''RUT''' – The '''RUTX11''' in this case will be connected to '''Fortinet''' for basic internet access. '''RUT''' has a LAN subnet of 192.168.1.0/24 and WAN subnet of 192.168.10.1/24 configured on it.
   −
'''RUT''' – '''RUTX11''' will act as a '''spoke'''. A spoke is a client, that will be connected to the spoke (IPsec initiator). It will be connected to a '''hub''' for basic internet access. RUTX11 has a LAN subnet of 192.168.1.0/24 and WAN subnet of 192.168.10.1/24 configured on it.
     −
==Fortigate (Hub) configuration==
+
==Fortinet (Hub) configuration==
−
Start by configuring the hub (Fortigate) device. Login to the WebUI, navigate to '''VPN → IPsec Tunnels → Create new → IPsec Tunnel → Template Custom'''. Configure everything as follows.  
+
Start by configuring the hub (Fortinet) device. Login to the WebUI, navigate to '''VPN → IPsec Tunnels → Create new → IPsec Tunnel → Template Custom'''. Configure everything as follows.  
    
'''Note:''' ''Not specified fields can be left as is or changed according to your needs.''
 
'''Note:''' ''Not specified fields can be left as is or changed according to your needs.''
 
===Network configuration===
 
===Network configuration===
 
----
 
----
 +
Make the following changes:
 
# Remote Gateway – '''''Static IP Address;'''''
 
# Remote Gateway – '''''Static IP Address;'''''
 
# IP Address – '''''192.168.10.1;'''''
 
# IP Address – '''''192.168.10.1;'''''
Line 33: Line 34:  
===Authentication configuration===
 
===Authentication configuration===
 
----
 
----
 +
Make the following changes:
 
# Method – '''''Pre-shared Key;'''''
 
# Method – '''''Pre-shared Key;'''''
 
# Pre-shared Key – '''''your desired password;'''''
 
# Pre-shared Key – '''''your desired password;'''''
Line 39: Line 41:  
===Phase 1 Proposal configuration===
 
===Phase 1 Proposal configuration===
 
----
 
----
 +
Make the following changes:
 
# Encryption – '''''AES256;'''''
 
# Encryption – '''''AES256;'''''
 
# Authentication -  '''''SHA512;'''''
 
# Authentication -  '''''SHA512;'''''
Line 46: Line 49:  
===Phase 2 Selectors configuration===
 
===Phase 2 Selectors configuration===
 
----
 
----
 +
Make the following changes:
 
'''''Click on Advanced settings;'''''
 
'''''Click on Advanced settings;'''''
 
# Encryption – '''''AES256;'''''
 
# Encryption – '''''AES256;'''''
Line 54: Line 58:  
[[File:Fortigate_IPsec_Phase2_Proposal_Configuration.png|border|class=tlt-border|center]]
 
[[File:Fortigate_IPsec_Phase2_Proposal_Configuration.png|border|class=tlt-border|center]]
    +
===Firewall configuration===
 +
After setting up our IPsec instance, we will need to configure our firewall accordingly. Navigate to '''Policy & Objects → Firewall Policy → and click on a Create new button.'''. Configure everything as follows.
 +
----
 +
Make the following changes:
 +
# Incoming interface - '''''Tunnel interface name (In this case it is Teltonika);'''''
 +
# Outgoing interface - '''''wan2 (choose WAN port from which Fortinet gets internet);'''''
 +
# Source - '''''192.168.1.0/255.255.255.0;'''''
 +
# Destination - '''all;'''
 +
# Service - '''ALL;'''
 +
[[File:Fortinet_Ipsec_Firewall_default_route.png|border|class=tlt-border|center]]
 +
===Static Routes configuration===
 +
After setting up our IPsec instance and firewall, we will need to configure our static route accordingly. Navigate to '''Network → Static routes → and click on a Create new button.'''. For that we will need to create two static routes, one for blackhole and one for accessing our RUT device, configure everything as follows.
 +
----
 +
Make the following changes:
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=330; style="border-bottom: 1px solid white;></th>
 +
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Fortinet_IPsec_Add_route_tunnel.png|border|class=tlt-border|center]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 4px solid white>
 +
# Destination - '''''192.168.1.0/255.255.255.0;'''''
 +
# Interface - '''''Tunnel interface name (In this case it is Teltonika);'''''
 +
        </td>
 +
    </tr>
 +
</table>
 +
----
 +
Then create a new static route for blackhole.
 +
Make the following changes:
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=330; style="border-bottom: 1px solid white;></th>
 +
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Fortinet_IPsec_Add_route_blackhole.png|border|class=tlt-border|center]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 4px solid white>
 +
# Destination - '''''192.168.1.0/255.255.255.0;'''''
 +
# Interface - '''''Blackhole;'''''
 +
        </td>
 +
    </tr>
 +
</table>
 
==RUT (Spoke) configuration==
 
==RUT (Spoke) configuration==
 
Start by configuring the spoke (RUT) device. Login to the WebUI, navigate to '''Services → VPN → IPsec and add a new IPsec instance.''' Configure everything as follows.  
 
Start by configuring the spoke (RUT) device. Login to the WebUI, navigate to '''Services → VPN → IPsec and add a new IPsec instance.''' Configure everything as follows.  
Line 59: Line 104:  
===Instance configuration===
 
===Instance configuration===
 
----
 
----
 +
Make the following changes:
 
# '''''Enable''''' instance;
 
# '''''Enable''''' instance;
−
# Remote endpoint - '''''Fortigate WAN IP;'''''
+
# Remote endpoint - '''''Fortinet WAN IP;'''''
 
# Authentication method - '''''Pre-shared key;'''''
 
# Authentication method - '''''Pre-shared key;'''''
−
# Pre-shared key - the '''''same password''''' you have '''''set on Fortigate''''' when configuring the '''''Fortigate HUB instance;'''''
+
# Pre-shared key - the '''''same password''''' you have '''''set on Fortinet''''' when configuring the '''''Fortinet HUB instance;'''''
 
# Local identifier – '''''RUT WAN IP;'''''
 
# Local identifier – '''''RUT WAN IP;'''''
−
# Remote identifier – '''''Fortigate WAN IP;'''''
+
# Remote identifier – '''''Fortinet WAN IP;'''''
 
[[File:Networking_webui_manual_IPsec_Instance_Configuration.png|border|class=tlt-border|center]]
 
[[File:Networking_webui_manual_IPsec_Instance_Configuration.png|border|class=tlt-border|center]]
 
===Connection general section configuration===
 
===Connection general section configuration===
 
----
 
----
 +
Make the following changes:
 
# Mode - '''''Start;'''''
 
# Mode - '''''Start;'''''
 
# Type - '''''Tunnel;'''''
 
# Type - '''''Tunnel;'''''
Line 78: Line 125:  
===Connection advanced section configuration===
 
===Connection advanced section configuration===
 
----
 
----
 +
Make the following changes:
 
# '''''Enable local firewall'''''
 
# '''''Enable local firewall'''''
 
#Remote DNS – '''''8.8.8.8;'''''
 
#Remote DNS – '''''8.8.8.8;'''''
Line 84: Line 132:  
===Proposal configuration===
 
===Proposal configuration===
 
----
 
----
−
 
+
Make the following changes:
 
<table class="nd-othertables_2">
 
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
Line 118: Line 166:     
==Testing the configuration==
 
==Testing the configuration==
−
 
+
----
 
If you have followed all the above steps, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly.  
 
If you have followed all the above steps, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly.  
   Line 124: Line 172:     
[[File:Networking_ssh_manual_IPsec_configuration_IPsec_statusall_test_v1.png|border|class=tlt-border|971x135px|center]]
 
[[File:Networking_ssh_manual_IPsec_configuration_IPsec_statusall_test_v1.png|border|class=tlt-border|971x135px|center]]
−
 
+
----
−
Also, as the hub should be reachable by spoke, we can try pinging the hub using <code><span class="highlight" >'''ping 192.168.5.99'''</span></code>:
+
Also, we should be able to access internet routed via Fortigate, we can check it out by pinging 8.8.8.8 and checking what public IP we get by executing this command via command line on RUT device: <code><span class="highlight" >'''curl icanhazip.com'''</span></code> and <code><span class="highlight" >'''ping 8.8.8.8'''</span></code>:
−
[[File:Networking_ssh_manual_IPsec_configuration_test_ping_v1.png|border|class=tlt-border|506x133px|center]]
+
[[File:RutIpsecCurlPingTest.png|border|class=tlt-border|506x133px|center]]
 +
----
 +
To check if IPsec tunnel is working properly from hub (Fortinet), we can try pinging our spoke (RUT) by using this command in command line interface on Fortinet<code><span class="highlight" >'''exec ping 192.168.1.1'''</span></code>, if you are not able to ping spoke (RUT), try changing the source interface from which we try pinging, by executing this command <code><span class="highlight" >'''exec ping-options source 192.168.5.99'''</span></code>:
 +
[[File:Fortinet_IPsec_test_ping.png|border|class=tlt-border|center]]
 
==See also==
 
==See also==
   Line 135: Line 186:  
[https://openwrt.org/docs/guide-user/services/vpn/strongswan/basics OpenWrt Ipsec basics]
 
[https://openwrt.org/docs/guide-user/services/vpn/strongswan/basics OpenWrt Ipsec basics]
   −
[https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/762500/general-ipsec-vpn-configuration Fortigate Ipsec configuration]
+
[https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/762500/general-ipsec-vpn-configuration Fortinet Ipsec configuration]
Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/127033...127060"