5. Fortigate IPSEC VPN with CISCO ASA, VDOM, AWS Snapshot, Packet Capture
0. Snapshot
1. Assigned Interfaces to VDOM
2. VPN Create with Cisco ASA
Before, I used one of Virtual Private Gateway or Cisco CSR in AWS
But This time i will configure fortigate for vpn directly
3. Use VPN wizard in Fortigate
Access to SSH
config vpn ipsec phase1-interface
edit ASA
unset wizard-type
Turn back to GUI
Change from IKEv1 to IKEv2
Encryption 3DES-SHA1
Encryption AES192-SHA1
DH Group 5
Lifetime 86400
4. Configure IPSEC in ASA5520(OS 917-9)
crypto ikev2 policy 10
encryption 3des
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
object network 172.31.0.0
subnet 172.31.0.0 255.255.0.0
object network 10.63.251.0
subnet 10.63.251.0 255.255.255.0
access-list fortigate extended permit ip object 10.63.251.0 object 172.31.0.0
tunnel-group 52.78.114.128 type ipsec-l2l
tunnel-group 52.78.114.128 ipsec-attributes
ikev2 remote-authentication pre-shared-key keywordnetwork
ikev2 local-authentication pre-shared-key keywordnetwork
crypto ipsec ikev2 ipsec-proposal fortigate
protocol esp encryption 3des
protocol esp integrity sha-1
crypto map fortigate 10 match address fortigate
crypto map fortigate 10 set peer 52.78.114.128
crypto map fortigate 10 set ikev2 ipsec-proposal fortigate
crypto map fortigate interface outside
Trouble Shooting
Packet Capture in Fortigate