Setting up secure remote access across distributed networks requires precision. A misconfigured firewall tunnel exposes internal resources to unauthorized traffic or drops legitimate packets due to cryptographic mismatches. Configuring an IPsec VPN on a FortiGate firewall bridges remote branch offices or remote users to your central infrastructure safely, using encryption standards like AES and secure hashing algorithms.
When configuring an IPsec tunnel on FortiOS, administrators must align Phase 1 and Phase 2 parameters precisely with the remote peer. Any discrepancy in pre-shared keys, proposal sets, or lifetime settings halts communication instantly. This guide walks through the exact operational sequence required to build, verify, and troubleshoot a site-to-site or remote-access IPsec VPN on FortiGate devices without relying on generic wizard defaults.
Preparing the FortiGate Environment
Before building the IPsec tunnel, verify core network parameters and interface states. Your FortiGate unit needs a stable public IP address on its external interface, or a properly mapped NAT environment if it sits behind an upstream router.
Check your internal routing table to ensure the local subnet doesn't overlap with the remote network. Overlapping subnets cause routing loops and packet drops. Document your local subnet, the remote peer IP address, and the remote subnet before opening the FortiGate command line or web interface. Related reporting on this trend has been published by BBC.
Make sure your firmware version supports the cryptographic suites you plan to use. Modern deployments should default to IKEv2 for faster negotiation and better handling of mobility, though legacy peers might still require IKEv1.
Configuring Phase 1 Settings (IKE)
Phase 1 establishes a secure, authenticated channel between the two firewalls using Internet Key Exchange (IKE). This phase negotiates how the peers will authenticate each other and how they will secure the control traffic.
Navigate to VPN > IPsec Tunnels in the FortiGate GUI and create a new custom tunnel. Alternatively, use the CLI for precise control.
config vpn ipsec phase1-interface
edit "HQ-to-Branch"
set interface "wan1"
set ike-version 2
set remote-ip 203.0.113.50
set proposal aes256gcm-prfsha256
set local-id "hq-firewall"
set psksecret "SuperSecretPreSharedKey123!"
next
end
Key parameters to verify during Phase 1:
- Interface: The physical or logical WAN interface facing the public internet.
- IKE Version: Choose version 2 for improved stability and reduced handshake latency.
- Remote Gateway: The public IP address or FQDN of the remote peer.
- Authentication Method: Pre-shared key (PSK) or signature-based certificates. PSK remains the standard for most mid-market deployments.
- Proposal: Match cryptographic algorithms strictly with the remote peer. Combining AES-256 encryption with SHA-256 hashing provides a secure baseline. Avoid outdated protocols like 3DES or MD5.
Configuring Phase 2 Settings (IPsec)
Phase 2 negotiates the security associations (SAs) that protect the actual data flow passing through the tunnel. While Phase 1 secures the management conversation, Phase 2 secures the user data payload.
Define the encryption selectors, known as quick mode selectors or proxy IDs, to specify which subnets can communicate through the tunnel.
config vpn ipsec phase2-interface
edit "HQ-to-Branch-P2"
set phase1name "HQ-to-Branch"
set proposal aes256-sha256
set src-addr-type subnet
set dst-addr-type subnet
set src-subnet 192.168.1.0 255.255.255.0
set dst-subnet 192.168.2.0 255.255.255.0
next
end
Ensure that the source subnet on your local FortiGate matches the destination subnet on the remote peer, and vice versa. Mismatched proxy IDs are the single most common cause of IPsec tunnel failures.
Establishing Static Routes and Firewall Policies
Once the IPsec tunnel interface exists, traffic cannot flow until you configure explicit static routes and firewall policies. The tunnel interface acts as a logical gateway for traffic destined for the remote network.
Create a static route pointing to the remote subnet through the newly created IPsec interface:
config router static
edit 0
set dst 192.168.2.0 255.255.255.0
set device "HQ-to-Branch"
next
end
Next, write bidirectional firewall policies to permit traffic. FortiGate firewalls deny all traffic by default. You need a policy allowing traffic from your internal interface to the IPsec tunnel interface, and a matching policy for the reverse direction if the remote site initiates connections.
- Incoming Interface: internal
- Outgoing Interface: HQ-to-Branch
- Source Address: Local subnet object
- Destination Address: Remote subnet object
- Action: ACCEPT
- NAT: Disabled (NAT must be turned off for VPN traffic to preserve internal source IPs).
For detailed reference on secure firewall management and interface zoning, consult the Fortinet Documentation Library.
Troubleshooting Common IPsec Tunnel Failures
When a tunnel fails to come up, systematic debugging saves hours of frustration. Start by checking the IKE negotiation status via the CLI.
diagnose vpn ike log-filter remote-ip 203.0.113.50
diagnose debug application ike -1
diagnose debug enable
Look for specific error codes in the debug output:
- No Proposal Chosen: This indicates a cryptographic mismatch between Phase 1 or Phase 2 settings on the two peers. Check your encryption and authentication algorithms.
- Phase 1 Negotiation Timeout: Usually points to a routing issue, an incorrect remote IP address, or intermediate firewalls blocking UDP ports 500 (IKE) and 4500 (NAT-T).
- Dead Peer Detection (DPD) Disconnects: If tunnels drop randomly after a period of inactivity, adjust DPD settings or enable keepalives to prevent state timeouts across stateful NAT devices.
You can also review networking best practices through the Cybersecurity and Infrastructure Security Agency to ensure your cryptographic implementations align with current federal standards.
Frequently Asked Questions
What is the difference between IKEv1 and IKEv2 on FortiGate?
IKEv2 offers faster connection setups, built-in deadlock recovery, and better handling of mobile clients switching networks. IKEv1 remains useful only when connecting to legacy third-party hardware that lacks IKEv2 support.
Why is my IPsec tunnel up, but traffic won't pass?
This typically stems from missing static routes or incorrect firewall policies. Verify that NAT is disabled on your firewall policies governing the VPN traffic, and check that proxy IDs match on both ends.
How do I handle overlapping subnets across a site-to-site VPN?
If your local and remote sites use the same internal subnet (such as 192.168.1.0/24), IPsec routing fails. You must implement Network Address Translation (NAT) on the FortiGate to map conflicting IP ranges into non-overlapping virtual subnets.
Should I use Pre-Shared Keys or Certificates?
Pre-shared keys work well for site-to-site tunnels between two organization-owned firewalls with administrative control. Certificates provide stronger security and scalability for large remote-access deployments involving hundreds of individual user endpoints.
