VPN Gateway:Configure a FortiGate firewall

Static routing

1. Open the FortiGate CLI.

2. Configure Phase 1 (IKE) for both tunnels.

   # Tunnel 1 Phase 1
   config vpn ipsec phase1-interface
    edit "to_ali_tun1"
    set interface "port1"             # WAN interface (public network egress)
    set ike-version 2
    set peertype any
    set net-device disable
    set proposal des-sha1
    set localid-type address          # Match the remoteid format on Alibaba Cloud
    set dhgrp 2
    set dpd on-idle                   # Enable Dead Peer Detection (DPD) to detect tunnel failures
    set keylife 86400                 # IKE SA lifetime: 86400 seconds (24 hours)
    set remote-gw 8.XX.XX.146         # IPsec address 1 of the VPN Gateway
    set psksecret 123456****          # Must match the pre-shared key on Alibaba Cloud
    next
   end
   
   # Tunnel 2 Phase 1
   config vpn ipsec phase1-interface
    edit "to_ali_tun2"
    set interface "port1"             # WAN interface (public network egress)
    set ike-version 2
    set peertype any
    set net-device disable
    set proposal des-sha1
    set localid-type address          # Match the remoteid format on Alibaba Cloud
    set dhgrp 2
    set dpd on-idle                   # Enable DPD to detect tunnel failures
    set keylife 86400                 # IKE SA lifetime: 86400 seconds (24 hours)
    set remote-gw 8.XX.XX.74          # IPsec address 2 of the VPN Gateway
    set psksecret 123456****          # Must match the pre-shared key on Alibaba Cloud
    next
   end

3. Configure Phase 2 (IPsec) for both tunnels.

   # Tunnel 1 Phase 2
   config vpn ipsec phase2-interface
       edit "to_ali_tun1"
           set phase1name "to_ali_tun1"    # Bind to Tunnel 1 Phase 1 interface
           set proposal des-sha1
           set dhgrp 2
           set auto-negotiate enable
           set keylifeseconds 86400
       next
   end
   
   # Tunnel 2 Phase 2
   config vpn ipsec phase2-interface
       edit "to_ali_tun2"
           set phase1name "to_ali_tun2"    # Bind to Tunnel 2 Phase 1 interface
           set proposal des-sha1
           set dhgrp 2
           set auto-negotiate enable
           set keylifeseconds 86400
       next
   end

4. Configure firewall policies to allow traffic in both directions over each tunnel.

   # Define address objects
   config firewall address
       edit "Local_192.168.0.0/16"
           set subnet 192.168.0.0 255.255.0.0
       next
       edit "Remote_10.0.0.0/16"
           set subnet 10.0.0.0 255.255.0.0
       next
   end
   
   # Firewall policies
   config firewall policy
       edit 100
           set name "forti_to_alibabacloud1"   # Data center to VPC over Tunnel 1
           set srcintf "port2"
           set dstintf "to_ali_tun1"
           set action accept
           set srcaddr "Local_192.168.0.0/16"
           set dstaddr "Remote_10.0.0.0/16"
           set schedule "always"
           set service "ALL"
       next
       edit 101
           set name "aliyun_to_forti1"         # VPC to data center over Tunnel 1
           set srcintf "to_ali_tun1"
           set dstintf "port2"
           set action accept
           set srcaddr "Remote_10.0.0.0/16"
           set dstaddr "Local_192.168.0.0/16"
           set schedule "always"
           set service "ALL"
       next
       edit 102
           set name "forti_to_alibabacloud2"   # Data center to VPC over Tunnel 2
           set srcintf "port2"
           set dstintf "to_ali_tun2"
           set action accept
           set srcaddr "Local_192.168.0.0/16"
           set dstaddr "Remote_10.0.0.0/16"
           set schedule "always"
           set service "ALL"
       next
       edit 103
           set name "aliyun_to_forti2"         # VPC to data center over Tunnel 2
           set srcintf "to_ali_tun2"
           set dstintf "port2"
           set action accept
           set srcaddr "Remote_10.0.0.0/16"
           set dstaddr "Local_192.168.0.0/16"
           set schedule "always"
           set service "ALL"
       next
   end

5. Add static routes to the VPC. Assign a lower administrative distance to Tunnel 1 to make it the preferred path.

   On FortiOS 6.x, use set priority instead of set distance to configure route preference.

   config router static
       edit 100
           set dst 10.0.0.0 255.255.0.0
           set distance 1                    # Lower distance = higher priority (Tunnel 1 is active)
           set device "to_ali_tun1"
       next
       edit 101
           set dst 10.0.0.0 255.255.0.0
           set distance 10                   # Higher distance = standby (Tunnel 2 takes over if Tunnel 1 fails)
           set device "to_ali_tun2"
       next
   end

BGP dynamic routing

Steps 1–4 are the same as static routing. Complete Phase 1, Phase 2, and firewall policy configuration first, then continue with the BGP-specific steps below.

1. Open the FortiGate CLI.

2. Configure Phase 1 (IKE) for both tunnels — same as static routing step 2.

3. Configure Phase 2 (IPsec) for both tunnels — same as static routing step 3.

4. Configure firewall policies — same as static routing step 4.

5. Assign BGP IP addresses to the tunnel interfaces.

   config system interface
       edit "to_ali_tun1"
           set ip 169.254.10.2 255.255.255.255          # Local BGP IP for Tunnel 1
           set remote-ip 169.254.10.1 255.255.255.255   # Remote BGP IP for Tunnel 1 (VPN Gateway)
       next
       edit "to_ali_tun2"
           set ip 169.254.20.2 255.255.255.255          # Local BGP IP for Tunnel 2
           set remote-ip 169.254.20.1 255.255.255.255   # Remote BGP IP for Tunnel 2 (VPN Gateway)
       next
   end

6. Configure BGP and advertise the data center CIDR block to Alibaba Cloud.

   config router bgp
       set as 65500
       set router-id 122.XX.XX.248
       config neighbor
           edit "169.254.10.1"                       # BGP peer for Tunnel 1 (VPN Gateway)
               set remote-as 65535
           next
           edit "169.254.20.1"                       # BGP peer for Tunnel 2 (VPN Gateway)
               set remote-as 65535
           next
       end
       config network
           edit 100
               set prefix 192.168.0.0 255.255.0.0    # Advertise the data center CIDR block to the VPC
           next
       end
       config redistribute connected                 # Redistribute directly connected routes to BGP
           set status enable
       end
   end