FCP_FGT_AD-7.4 VPN

VPN Detailed Explanation

A Virtual Private Network (VPN) is a secure way to connect devices or networks over an encrypted channel. FortiGate supports multiple VPN types for different use cases.

5.1 SSL VPN

SSL VPNs provide encrypted access to a network using the SSL/TLS protocol. They are particularly useful for remote users who need secure access to internal resources.

Modes of SSL VPN

1. Web Mode:

   • Allows users to access internal resources directly through a browser interface.
   • Common use cases:
     • Access file shares, internal websites, or web-based applications.
   • Advantages:
     • No need to install additional software.
     • Easy access from any device with a browser.
   • Limitations:
     • Limited to HTTP/HTTPS-based services.

2. Tunnel Mode:

   • Establishes a full tunnel between the remote device and the internal network using FortiClient.
   • Advantages:
     • Provides access to all internal resources (not limited to web applications).
     • Encrypts all traffic between the client and network.
   • Requirements:
     • FortiClient VPN software installed on the user's device.

Configuration Workflow

1. Define User Groups:

   • Create or import user accounts (local or external authentication via LDAP, RADIUS).

   • Example (CLI):

     config user group
     edit "SSLVPN_Users"
     set member "user1" "user2"
     end
     

2. Configure SSL VPN Portal:

   • Define the listening port and address ranges for SSL VPN connections.

   • Example (CLI):

     config vpn ssl settings
     set servercert "Fortinet_CA"
     set port 443
     set tunnel-ip-pools "SSLVPN_Tunnel_Range"
     end
     

   • Define the portal:

     config vpn ssl web portal
     edit "Full_Access"
     set tunnel-mode enable
     set web-mode enable
     set ip-pools "SSLVPN_Tunnel_Range"
     end
     

3. Set Up Policies to Allow Resource Access:

   • Create policies to allow SSL VPN traffic to reach internal resources.

   • Example (CLI):

     config firewall policy
     edit 10
     set srcintf "ssl.root"
     set dstintf "lan"
     set srcaddr "all"
     set dstaddr "Server_Subnet"
     set action accept
     set schedule "always"
     set service "ALL"
     end
     

5.2 IPsec VPN

IPsec VPNs are widely used for site-to-site connections or remote access scenarios. They provide secure tunnels for encrypted communication.

Site-to-Site IPsec VPN

1. Purpose:

   • Used to connect two networks securely, such as a corporate headquarters and branch offices.

2. Configuration Steps:

   • Define IKE (Internet Key Exchange) policies for Phase 1 and Phase 2.

   Phase 1 Configuration:

   • Establishes the secure tunnel and authenticates peers.

   • Example (CLI):

     config vpn ipsec phase1-interface
     edit "SiteA_to_SiteB"
     set interface "wan1"
     set ike-version 2
     set authmethod psk
     set psksecret "PreSharedKey"
     set proposal aes256-sha256
     set peerip 192.0.2.2
     end
     

   Phase 2 Configuration:

• Handles encryption for the data traveling through the tunnel.

• Example:

  config vpn ipsec phase2-interface
  edit "P2_SiteA_to_SiteB"
  set phase1name "SiteA_to_SiteB"
  set proposal aes256-sha256
  set src-subnet 192.168.1.0/24
  set dst-subnet 192.168.2.0/24
  end
  

• Create a policy to allow traffic through the VPN:

  config firewall policy
  edit 20
  set srcintf "SiteA_to_SiteB"
  set dstintf "lan"
  set srcaddr "all"
  set dstaddr "all"
  set action accept
  set schedule "always"
  set service "ALL"
  end
  

Remote Access IPsec VPN

1. Purpose:

   • Provides secure remote access for users connecting to the internal network using the IPsec protocol.

2. Configuration Steps:

   • Similar to site-to-site VPN, but with a dynamic peer IP for remote users.

   Example CLI:

   config vpn ipsec phase1-interface
   edit "Remote_IPsec"
   set interface "wan1"
   set mode aggressive
   set authmethod psk
   set psksecret "RemoteKey"
   set proposal aes256-sha256
   end
   

Advanced Features

1. Dead Peer Detection (DPD):

   • Monitors the health of the tunnel and terminates it if the peer is unreachable.

   • CLI Example:

     set dpd enable
     set dpd-retryinterval 10
     

2. Redundant Tunnels for Failover:

   • Configure multiple IPsec tunnels to provide failover in case the primary tunnel goes down.
   • Example:
     • Primary tunnel: SiteA_to_SiteB_Primary.
     • Backup tunnel: SiteA_to_SiteB_Backup.

Summary

• SSL VPN: Ideal for remote access with support for web-based or full tunnel modes.
• IPsec VPN: Best for secure connections between fixed sites or for remote user access.
• Advanced Features: DPD ensures stability, while redundant tunnels provide high availability.

By following these workflows, you can set up VPNs on FortiGate to securely connect users and networks.

VPN (Additional Content)

1. SSL VPN Security Policies – Source Interface

When configuring SSL VPN access in FortiGate, it's important to understand how traffic flows from VPN clients to internal resources.

Key Point:

The source interface in the firewall policy for SSL VPN traffic is ssl.root, not a physical interface like port1 or wan1.

Why this matters:

• SSL VPN traffic is handled by a virtual interface created by FortiGate named ssl.root.
• Many beginner admins mistakenly configure the source interface as wan1 or internal, which breaks VPN functionality.
• This is a common exam trap—expect scenario questions asking which interface must be used in a policy for SSL VPN.

Correct Policy Example:

config firewall policy
edit 10
set srcintf "ssl.root"
set dstintf "lan"
set srcaddr "all"
set dstaddr "Internal_Network"
set action accept
set service "ALL"
set schedule "always"
end

2. Mode-cfg for Remote IPsec VPN

When configuring Remote Access IPsec VPNs, FortiGate must dynamically assign IP addresses to remote users who connect using FortiClient.

This is done using mode-cfg (mode configuration), which allows FortiGate to function like a DHCP server for VPN clients.

Relevant Commands:

config vpn ipsec phase1-interface
edit "RemoteAccess"
set mode-cfg enable
set ipv4-start-ip 10.10.10.10
set ipv4-end-ip 10.10.10.20
set ipv4-netmask 255.255.255.0
end

Use Case:

• Remote users connect to the VPN gateway with no fixed IP.
• FortiGate assigns IPs from a configured pool (e.g., 10.10.10.10 to 10.10.10.20).
• These IPs are typically part of the RemoteUsers address object used in firewall policies.

Exam Tip:

You may be asked which feature is responsible for assigning IPs to remote IPsec VPN users—answer: mode-cfg.

3. IKEv1 vs. IKEv2

IKE (Internet Key Exchange) is the protocol used in IPsec VPN Phase 1 negotiations. FortiGate supports both IKEv1 and IKEv2.

IKEv1

• Traditional standard (RFC 2409)
• Slower negotiation, less efficient
• Two modes:
  • Main mode (more secure, more messages)
  • Aggressive mode (faster, less secure)

IKEv2

• Modern standard (RFC 7296)
• Faster, more efficient connection setup
• Built-in support for mobility and multihoming (MOBIKE)
• Improved error handling and resilience

CLI Command:

set ike-version 2

When to use which:

• Use IKEv2 for modern deployments and better performance.
• Use IKEv1 aggressive mode only for remote peers with dynamic IPs or older devices.

Exam Insight:

You may see a multiple-choice question comparing features of IKEv1 vs. IKEv2 or asking which is recommended for modern VPN deployments (Answer: IKEv2).

4. Common VPN Troubleshooting Tips

VPN configuration errors can occur at many levels. Here are common issues and where to look for answers.

Scenario: Phase 1 is up, but Phase 2 fails

Possible causes:

• Mismatched encryption proposals in Phase 2.
• Incorrect or mismatched source/destination subnets.
• Missing or incorrect firewall policies allowing VPN traffic.

Diagnosing VPN Tunnel Status

Command to list active tunnels:

diagnose vpn tunnel list

Command to view Phase 1 negotiation:

diagnose debug application ike -1
diagnose debug enable

Other helpful commands:

• get vpn ipsec tunnel summary
• diagnose vpn ike gateway list
• diagnose debug reset (to clear debug output)

Best Practices:

• Always confirm both Phase 1 and Phase 2 are up.
• Use sniffer command (diagnose sniffer packet any 'port 500 or 4500' 4) to monitor IKE traffic.
• Verify firewall policies in both directions for site-to-site tunnels.

Summary Table

Topic	Description	Exam Relevance
SSL VPN Source Interface	Must use ssl.root as source in firewall policy	High – common trap
Mode-cfg for IPsec Remote VPN	Assigns IP addresses to remote users	Medium – CLI focused
IKEv1 vs. IKEv2	Understanding trade-offs in negotiation protocols	Medium – comparison
VPN Troubleshooting	Commands and scenarios to resolve tunnel failures	High – practical skill