Old Sen's Tales IT Help

SonicWall FortiGate firewall Site-to-Site VPN setup

　　三年前曾試過為Sonicwall NSA 2400與FortiGate 110C建立Site to Site VPN，不過失敗了，後來測試Juniper 5GT與Sonicwall倒是成功。最近又有需求要與一台FortiGate 110C建VPN，雖然手上已經有另一台FortiGate 110C，照理說直接用同型號來建會省事很多，但我還是想再試一次用Sonicwall來建，看看能不能找出當初失敗的原因，來回測試一整天，總算搞定。

雙方環境如下：

Sonicwall NSA 4600

FortiGate 110C

Lan:
192.168.1.0/24
192.168.2.0/24

Wan:
203.1.2.3

Lan:
192.168.100.0/24
　

Wan:
203.4.5.6

【Sonicwall設定】
1.建Object
「Network」->「Address Objects」
Name: FortiGate_network
Zone Assignment: VPN
Type: Network
Network: 192.168.100.0
Netmask: 255.255.255.0
OK

2.設定VPN Tunnel
「VPN」
Enable VPN
i
–General tab
IPSec Keying Mode: IKE using Preshared Secret.
Name: FortiGate_network
IPSec primary Gateway Name or Address: 203.4.5.6
Shared Secret: 設一組密碼
Local IKE ID: IP Address (保留空白)
Peer IKE ID: IP Address (保留空白)

–Network tab
Local Network：LAN Primary Subnet(192.168.1.0/24、192.168.2.0/24)
Destination Networks：FortiGate_network.

–Proposals tab
IKE (Phase1) Proposal
Exchange: Main Mode
DH Group: Group 2
Encryption: 3DES
Authentication: SHA1
Life Time: 28800

IKE (Phase2) Proposal
Protocol: ESP
Encryption: 3DES
Authentication: SHA1
不勾選「Enable perfect forward secrecy」
Life Time: 28800

–Advanced tab
Enable Keep Alive.
OK

接著設定FortiGate，有Tunnel及Interface兩種方式，二擇一設定即可。(官方教學是Tunnel模式)

【FortiGate設定—1.Tunnel模式】
1.設定VPN
「VPN」->「IPSec」->「Auto Key(IKE)」->「Phase 1」
「Create Phase 1」
Gateway Name: SonicWall
Remote Gateway: Static IP
IP Address: 203.1.2.3
Mode: Main
Authentication Method: Preshared Key
Pre-shared Key: 同上面Sonicwall設定的密碼

–Advanced
Encryption: 3DES
Authentication: SHA1
DH Group: 2
Keylife: 28800
Keep other settings as default。
OK

「VPN」->「IPSec」->「Auto Key(IKE)」->Phase 2
Create Phase 2
Tunnel Name: SonicWall-192.168.1.0
Remote Gateway: Select SonicWall
–Advanced
Encryption: 3DES
Authentication: SHA1
Do not check 'Enable perfect forward secrecy'(PFS)」
(If checked，Even if SonicWall is also checked，VPN may still fail to establish，原因不明，Interface mode does not have this problem)
Keylife: 28800
–Quick Mode Selector..
Source address：192.168.100.0/24
Destination address：192.168.1.0/24
OK
**Quick Mode must be set here to connect with SonicWall。Otherwise FortiGate will show”no matching gateway for new request”的錯誤。

設定第二個網段(192.168.2.0)
Create Phase 2
Tunnel Name: SonicWall-192.168.2.0
Remote Gateway: Select SonicWall
–Advanced
Encryption: 3DES
Authentication: SHA1
Do not check 'Enable perfect forward secrecy'(PFS)」
Keylife: 28800
–Quick Mode Selector..
Source address：192.168.100.0/24
Destination address：192.168.2.0/24
OK

2.Create Address
Firewall ->Address ->Address
Create New
name:FortiGate_network
IP address:192.168.100.0
subnet:255.255.255.0
OK

Create New
name:SonicWall_network_1
IP address:192.168.1.0
subnet::255.255.255.0
OK

Create New
name:SonicWall_network_2
IP address:192.168.2.0
subnet::255.255.255.0
OK

Set the two Sonicwall subnets as one group
Firewall ->Address ->Group
Create New
Group Name:SonicWall_network
Members:SonicWall_network_1、SonicWall_network_2
OK

3.設定防火牆規則
Firewall ->Policy>Policy
Create New
Source Interface: Port 1(or Internal)
Source Address: FortiGate_network
Destination Interface: WAN1 (or External)
Destination Address: SonicWall_network
Schedule: always
Service: ANY
Action: IPSEC (or Encrypt)
VPN Tunnel: SonicWall
Check Allow inbound
Check Allow outbound
OK

FortiGate Settings — 2. Interface Mode
1.設定VPN
「VPN」->「IPSec」->「Auto Key(IKE)」->「Phase 1」
「Create Phase 1」
Gateway Name: SonicWall
Remote Gateway: Static IP
IP Address: 203.1.2.3
Mode: Main
Authentication Method: Preshared Key
Pre-shared Key: 同上面Sonicwall設定的密碼

–Advanced
Check 'Enable IPsec Interface Mode'
Encryption: 3DES
Authentication: SHA1
DH Group: 2
Keylife: 28800
Keep other settings as default。
OK

「VPN」->「IPSec」->「Auto Key(IKE)」->Phase 2
Create Phase 2
Tunnel Name: SonicWall-192.168.1.0
Remote Gateway: SonicWall

–Advanced
Encryption: 3DES
Authentication: SHA1
不勾選Enable perfect forward secrecy(PFS)
Keylife: 28800

–Quick Mode Selector..
Source address：192.168.100.0/24
Destination address：192.168.1.0/24
OK
**Quick Mode must be set here to connect with SonicWall。Otherwise FortiGate will show”no matching gateway for new request”的錯誤。

設定第二個網段(192.168.2.0)
Create Phase 2
Tunnel Name: SonicWall-192.168.2.0
Remote Gateway: SonicWall

–Advanced
Encryption: 3DES
Authentication: SHA1
不勾選Enable perfect forward secrecy(PFS)
Keylife: 28800
–Quick Mode Selector..
Source address：192.168.100.0/24
Destination address：192.168.2.0/24
OK

2.建立路由
Router>Static>Static Route
Create New
Destination IP/Mask: 192.168.1.0/24
Device: SonicWall
OK

Create New
Destination IP/Mask: 192.168.2.0/24
Device: SonicWall
OK

3.設定防火牆規則
Firewall ->Policy>Policy
Create New
Source Interface: Port 1(or Internal)
Source Address: FortiGate_network
Destination Interface: SonicWall
Destination Address: SonicWall_network
Schedule: always
Service: ANY
Action: Accept
OK

Create New
Source Interface: SonicWall
Source Address: SonicWall_network
Destination Interface: Port 1(or Internal)
Destination Address: FortiGate_network
Schedule: always
Service: ANY
Action: Accept
OK

【參考連結】