Fortigate IKEv2 IPsec VPN CLI Templates

IKEv2 (Internet Key Exchange version 2) is the latest protocol for establishing IPsec VPN tunnels, offering improved performance, reliability and security over IKEv1. This blog post provides a comprehensive guide to configuring IKEv2 VPN tunnels on FortiGate firewalls, including templates for various scenarios.

To configure an IKEv2 VPN tunnel on a FortiGate firewall, you need the following information:

Phase 1 Configuration

• Encryption: The encryption algorithm (e.g. AES-256, AES-192, AES-128, 3DES)
• Integrity: The PRF hash algorithm (e.g. SHA-384, SHA-256, SHA-1, MD5)
• DH Group: The Diffie-Hellman group (e.g. 14, 19, 20, 21) for key exchange
• Lifetime: The lifetime of the IKE SA in seconds or kilobytes
• Pre-Shared Key (PSK): The shared secret key for authentication.
  • Authentication Methods
    • IKEv2 supports various authentication methods including Pre-Shared Key (PSK), EAP (Extensible Authentication Protocol) with RADIUS server, and certificate-based authentication. Generally, Pre-Shared Key is still used the majority of the time.

Phase 2 Configuration

• Encryption: The encryption algorithm for data encryption
• Integrity: The PRF hash algorithm for data authentication
• PFS (Perfect Forward Secrecy): Enable or disable PFS for additional key exchange
• Lifetime: The lifetime of the Child SA in seconds or kilobytes
• Encryption Domain: The local and remote subnets included in the VPN tunnel

Route-Based vs Policy-Based Site to Site VPN

• Similar to IKEv1, FortiGate supports both route-based and policy-based VPN configurations for IKEv2:

Route-Based VPN

• Uses static routes or dynamic routing protocols to direct traffic into the VPN tunnel interface
• More scalable for complex topologies like hub-and-spoke
• Supports exchanging dynamic routing info over the tunnel
• Requires firewall policies for the virtual tunnel interface

Policy-Based VPN

• Uses security policies to define which traffic goes through the VPN tunnel
• Easier to configure for simple point-to-point VPNs
• Does not directly exchange routing information
• Limited by the number of policies supported

Other key differences:

• Route-based VPNs support NAT for the virtual tunnel interface, policy-based VPNs cannot use NAT
• Policy-based is easier to configure for simple point-to-point VPNs
• Route-based is more scalable for complex topologies like hub-and-spoke

Route-based is generally recommended for greater flexibility and scalability.

So in summary, policy-based uses separate security policies per tunnel, while route-based utilizes routing to direct traffic into the VPN tunnel interface. Route-based is generally recommended for greater flexibility and scalability

IKEv2 Customer Request VPN Template

Hello <customer>,

Please provide the necessary information below to complete this site-to-site VPN tunnel request:

Phase 1:
------------------
Encryption: (e.g., AES-256, AES-192, AES-128, 3DES)
Hash: (e.g., SHA-256, SHA-1, MD5)
Authentication: (Pre-Shared Key or RSA Signature)
Lifetime: (e.g., 28800 seconds, 86400 kilobytes)
DH Group: (e.g., 14, 5, 2, 1)

Phase 2:
------------------
Encryption: (e.g., AES-256, AES-192, AES-128, 3DES)
Hash: (e.g., SHA-256, SHA-1, MD5)
PFS: (Enable [DH Group 14, 5, 2] or Disable)
Lifetime: (e.g., 3600 seconds, 4608000 kilobytes)

Encryption Domain:
------------------
Local Networks: (e.g., 10.1.1.0/24, 192.168.1.0/24)
Remote Networks: (e.g., 10.2.2.0/24, 172.16.0.0/16)

Please provide the requested information, and I'll be happy to assist you further with configuring the IKEv1 VPN tunnel on your FortiGate firewall.