VPN Gateway:FortiGateファイアウォールの設定

FortiGateファイアウォールのCLIに移動します。

フェーズ1のIPsec-VPN設定 (IKE設定とも呼ばれます) をFortiGateファイアウォールに追加します。

# Add Phase 1 IPsec-VPN configurations for Tunnel 1.
config vpn ipsec phase1-interface
 edit "to_aliyun_test1"
 set interface "port1"             # Set the interface to port1, which is the public network egress. 
 set ike-version 2
 set peertype any
 set net-device disable
 set proposal des-sha1             
 set localid-type address          # Set the format of localid to IP address, which is the same as that of remoteid of Tunnel 1 on Alibaba Cloud. 
 set dhgrp 2
 set remote-gw 8.XX.XX.146         # Set the remote address of Tunnel 1 to IPsec address 1 of the VPN gateway. 
 set psksecret 123456****          # Specify the pre-shared key for Tunnel 1. The pre-shared key on Alibaba Cloud must be the same as that on the FortiGate firewall. 
 next
end

# Add Phase 2 IPsec-VPN configurations for Tunnel 2.
config vpn ipsec phase1-interface
 edit "to_aliyun_test2"
 set interface "port1"             # Set the interface to port1, which is the public network egress. 
 set ike-version 2
 set peertype any
 set net-device disable
 set proposal des-sha1             
 set localid-type address          # Set the format of localid to IP address, which is the same as that of remoteid of Tunnel 2 on Alibaba Cloud. 
 set dhgrp 2
 set remote-gw 8.XX.XX.74          # Set the remote address of Tunnel 2 to IPsec address 2 of the VPN gateway. 
 set psksecret 123456****          # Specify the pre-shared key for Tunnel 2. The pre-shared key on Alibaba Cloud must be the same as that on the FortiGate firewall. 
 next
end

フェーズ2 IPsec-VPN設定 (IPsec設定とも呼ばれます) をFortiGateファイアウォールに追加します。

# Add Phase 2 IPsec-VPN configurations for Tunnel 1.
config vpn ipsec phase2-interface
    edit "to_aliyun_test1"
        set phase1name "to_aliyun_test1"    # Associate the interface with phase1-interface of Tunnel 1. 
        set proposal des-sha1
        set dhgrp 2
        set auto-negotiate enable
        set keylifeseconds 86400
    next
end

# Add Phase 2 IPsec-VPN configurations for Tunnel 2.
config vpn ipsec phase2-interface       
    edit "to_aliyun_test2"       
        set phase1name "to_aliyun_test2"     # Associate the interface with phase1-interface of Tunnel 2. 
        set proposal des-sha1
        set dhgrp 2
        set auto-negotiate enable
        set keylifeseconds 86400
    next
end

ファイアウォールポリシーを設定します。

config firewall policy
    edit 1
        set name "forti_to_aliyun1"       # Specify the traffic that is allowed from the FortiGate firewall to Alibaba Cloud over Tunnel 1. 
        set srcintf "port4"
        set dstintf "to_aliyun_test1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set name "aliyun_to_forti1"       # Specify the traffic that is allowed from Alibaba Cloud to the FortiGate firewall over Tunnel 1. 
        set srcintf "to_aliyun_test1"
        set dstintf "port4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 3
        set name "forti_to_aliyun2"        # Specify the traffic that is allowed from the FortiGate firewall to Alibaba Cloud over Tunnel 2. 
        set srcintf "port4"
        set dstintf "to_aliyun_test2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 4
        set name "aliyun_to_forti2"        # Specify the traffic that is allowed from Alibaba Cloud to the FortiGate firewall over Tunnel 2. 
        set srcintf "to_aliyun_test2"
        set dstintf "port4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

VPCへの静的ルートを設定します。

config router static
    edit 1
        set dst 10.0.0.0 255.255.0.0
        set priority 0 
        set device "to_aliyun_test1"
    next
    edit 2
        set dst 10.0.0.0 255.255.0.0
        set priority 10                   # Decrease the priority of the route pointing to Tunnel 2. This way, traffic is preferentially transmitted over Tunnel 1. 
        set device "to_aliyun_test2"
    next
end

FortiGateファイアウォールのCLIに移動します。

フェーズ1のIPsec-VPN設定 (IKE設定とも呼ばれます) をFortiGateファイアウォールに追加します。

# Add Phase 1 IPsec-VPN configurations for Tunnel 1.
config vpn ipsec phase1-interface
 edit "to_aliyun_test1"
 set interface "port1"             # Set the interface to port1, which is the public network egress. 
 set ike-version 2
 set peertype any
 set net-device disable
 set proposal des-sha1             
 set localid-type address          # Set the format of localid to IP address, which is the same as that of remoteid of Tunnel 1 on Alibaba Cloud. 
 set dhgrp 2
 set remote-gw 8.XX.XX.146         # Set the remote address of Tunnel 1 to IPsec address 1 of the VPN gateway. 
 set psksecret 123456****          # Specify the pre-shared key for Tunnel 1. The pre-shared key on Alibaba Cloud must be the same as that on the FortiGate firewall. 
 next
end

# Add Phase 2 IPsec-VPN configurations for Tunnel 2.
config vpn ipsec phase1-interface
 edit "to_aliyun_test2"
 set interface "port1"             # Set the interface to port1, which is the public network egress. 
 set ike-version 2
 set peertype any
 set net-device disable
 set proposal des-sha1             
 set localid-type address          # Set the format of localid to IP address, which is the same as that of remoteid of Tunnel 2 on Alibaba Cloud. 
 set dhgrp 2
 set remote-gw 8.XX.XX.74          # Set the remote address of Tunnel 2 to IPsec address 2 of the VPN gateway. 
 set psksecret 123456****          # Specify the pre-shared key for Tunnel 2. The pre-shared key on Alibaba Cloud must be the same as that on the FortiGate firewall. 
 next
end

フェーズ2 IPsec-VPN設定 (IPsec設定とも呼ばれます) をFortiGateファイアウォールに追加します。

# Add Phase 2 IPsec-VPN configurations for Tunnel 1.
config vpn ipsec phase2-interface
    edit "to_aliyun_test1"
        set phase1name "to_aliyun_test1"    # Associate the interface with phase1-interface of Tunnel 1. 
        set proposal des-sha1
        set dhgrp 2
        set auto-negotiate enable
        set keylifeseconds 86400
    next
end

# Add Phase 2 IPsec-VPN configurations for Tunnel 2.
config vpn ipsec phase2-interface       
    edit "to_aliyun_test2"       
        set phase1name "to_aliyun_test2"     # Associate the interface with phase1-interface of Tunnel 2. 
        set proposal des-sha1
        set dhgrp 2
        set auto-negotiate enable
        set keylifeseconds 86400
    next
end

ファイアウォールポリシーを設定します。

config firewall policy
    edit 1
        set name "forti_to_aliyun1"       # Specify the traffic that is allowed from the FortiGate firewall to Alibaba Cloud over Tunnel 1. 
        set srcintf "port4"
        set dstintf "to_aliyun_test1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set name "aliyun_to_forti1"       # Specify the traffic that is allowed from Alibaba Cloud to the FortiGate firewall over Tunnel 1. 
        set srcintf "to_aliyun_test1"
        set dstintf "port4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 3
        set name "forti_to_aliyun2"        # Specify the traffic that is allowed from the FortiGate firewall to Alibaba Cloud over Tunnel 2. 
        set srcintf "port4"
        set dstintf "to_aliyun_test2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 4
        set name "aliyun_to_forti2"        # Specify the traffic that is allowed from Alibaba Cloud to the FortiGate firewall over Tunnel 2. 
        set srcintf "to_aliyun_test2"
        set dstintf "port4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

トンネルインターフェイスのBGP IPアドレスを設定します。

config system interface
    edit "to_aliyun_test1"
        set ip 169.254.10.2 255.255.255.255          # Configure a BGP IP address for the interface of Tunnel 1. 
        set remote-ip 169.254.10.1 255.255.255.255   # Configure a remote BGP IP address for Tunnel 1. 
    next
    edit "to_aliyun_test2"
        set ip 169.254.20.2 255.255.255.255          # Configure a BGP IP address for the interface of Tunnel 2. 
        set remote-ip 169.254.20.1 255.255.255.255   # Configure a remote BGP IP address for Tunnel 2. 
    next
end

BGP動的ルーティングを設定します。

config router bgp
    set as 65500
    set router-id 122.XX.XX.248
    config neighbor
        edit "169.254.10.1"                       # Specify the BGP peer for Tunnel 1. 
            set remote-as 65535
        edit "169.254.20.1"
            set remote-as 65535                   # Specify the BGP peer for Tunnel 2. 
        next
    end
    config network
        edit 1
            set prefix 192.168.0.0 255.255.0.0    # Specify the CIDR block in the data center that needs to communicate with the VPC. 
        next
    end
        config redistribute "connected"           # Redistribute the route of the directly-connected interface to BGP. 
        set status enable
    end
end