NSE7_EFW-7.2 VPN

VPN Detailed Explanation

Virtual Private Networks (VPNs) enable secure communication over public or private networks. FortiGate supports multiple VPN types, including IPsec VPN, SSL VPN, and Auto-Discovery VPN (ADVPN).

5.1 IPsec VPN

IPsec VPNs are commonly used for secure, encrypted communication between two networks (site-to-site) or between a remote device and a network.

5.1.1 Site-to-Site VPN

• Purpose:

  • Connects two networks securely over the internet.
  • Often used between a corporate office and a branch office.

• Configuration Components:

  1. Phase 1 (IKE Negotiation):
     • Establishes a secure connection between the two endpoints.
     • Defines encryption (e.g., AES256) and authentication (e.g., SHA256) methods.
  2. Phase 2 (IPsec Tunnel):
     • Defines the traffic to be encrypted and additional encryption parameters.

• Configuration Steps:

  1. Phase 1 Setup:

     config vpn ipsec phase1-interface
        edit "Site-to-Site"
            set interface "port1"
            set peertype any
            set proposal aes256-sha256
            set psksecret "YourPSK"
            set remote-gw 203.0.113.1
        next
     end
     

  2. Phase 2 Setup:

     config vpn ipsec phase2-interface
        edit "P2-Site-to-Site"
            set phase1name "Site-to-Site"
            set proposal aes256-sha256
            set src-subnet 192.168.1.0/24
            set dst-subnet 192.168.2.0/24
        next
     end
     

  3. Create Policies:

     • Allow traffic between source and destination subnets.

     config firewall policy
        edit 1
            set srcintf "port1"
            set dstintf "port2"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set logtraffic all
        next
     end
     

5.1.2 IKEv2

• Why IKEv2?

  • Faster key exchange, better reliability, and support for NAT traversal.

• How to Enable IKEv2:

  • Add the following to the Phase 1 configuration:

    set ike-version 2
    

5.2 SSL VPN

SSL VPN provides secure remote access to corporate networks. It is easier to configure for end users than IPsec VPN and operates over HTTPS.

5.2.1 Web Mode and Tunnel Mode

• Web Mode:

  • Provides browser-based access to specific resources (e.g., file servers or intranet applications).
  • Ideal for users needing limited access.

• Tunnel Mode:

  • Creates a secure tunnel for full network access.
  • Suitable for employees requiring extensive access to corporate resources.

• Configuration Steps:

  1. Enable SSL VPN:

     config vpn ssl settings
        set servercert "Fortinet_Factory"
        set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
        set port 443
     end
     

  2. Configure User Access:

     • Create SSL VPN users in the local database or integrate with LDAP/RADIUS.

     config user local
        edit "remote-user"
            set type password
            set passwd "SecurePassword"
        next
     end
     

  3. Create SSL Policies:

     config firewall policy
        edit 2
            set srcintf "ssl.root"
            set dstintf "port2"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
        next
     end
     

5.2.2 User Authentication

• LDAP Integration:

  • Authenticate users using a corporate LDAP server.

  • Example configuration:

    config user ldap
        edit "LDAP_Server"
            set server "192.168.1.10"
            set cnid "uid"
            set dn "dc=example,dc=com"
        next
    end
    

• RADIUS Integration:

  • Use a RADIUS server for user authentication.

    config user radius
        edit "RADIUS_Server"
            set server "192.168.1.20"
            set secret "RADIUS_Secret"
        next
    end
    

5.3 Auto-Discovery VPN (ADVPN)

ADVPN simplifies VPN setup by dynamically creating tunnels between branch offices when needed.

5.3.1 Dynamic Tunnel Creation

• How It Works:

  • In traditional VPNs, all traffic is routed through a central hub, which may cause latency.
  • ADVPN allows branch offices to establish direct tunnels dynamically, bypassing the hub.

• Configuration Steps:

  1. Enable ADVPN in the hub:

     config vpn ipsec phase1-interface
        edit "Hub-ADVPN"
            set net-device enable
            set add-route enable
            set proposal aes256-sha256
            set remote-gw 0.0.0.0
        next
     end
     

  2. Enable dynamic tunnels in the branches:

     config vpn ipsec phase1-interface
        edit "Branch-ADVPN"
            set net-device enable
            set add-route enable
            set proposal aes256-sha256
            set remote-gw 192.168.1.1
        next
     end
     

5.3.2 Centralized Management

• Why Use FortiManager?

  • FortiManager can automate VPN configurations across multiple sites, saving time in large deployments.

• How to Configure VPNs in FortiManager:

  1. Add devices to FortiManager.
  2. Create a VPN community that includes hub and branch devices.
  3. Deploy the VPN configurations to all devices automatically.

Practical Example Workflow

Here’s how VPN features might be applied in a real-world scenario:

1. IPsec VPN:
   • Securely connect a branch office to the main office for shared file access.
2. SSL VPN:
   • Enable remote employees to access corporate resources securely from home.
3. ADVPN:
   • Allow two branch offices to communicate directly for faster collaboration.

Why VPNs are Important

VPNs are crucial for secure communication in both small and large networks. By mastering IPsec, SSL, and ADVPN configurations, you can build flexible and secure remote access solutions for any organization.

VPN (Additional Content)

1. Route-Based VPN vs Policy-Based VPN

Route-Based VPN (Interface-Based) – Default and Recommended

Key Characteristics:

• Creates a virtual interface (e.g., vpn-to-siteA) for the IPsec tunnel.
• Routing decisions are made based on the routing table.
• Offers greater flexibility and better integration with:
  • SD-WAN
  • Advanced routing (OSPF/BGP)
  • Diagnostics and monitoring tools

Configuration Steps:

• Create a Phase 1 interface.
• Create a Phase 2 selector.
• Add static routes or dynamic protocols pointing to the tunnel interface.
• Apply firewall policies using the tunnel interface as srcintf or dstintf.

Use Case:

• Complex enterprise networks, dynamic routing, or multiple tunnels.

Policy-Based VPN – Legacy Style

Key Characteristics:

• No virtual interface is created.
• VPN configuration is tied directly to a firewall policy.
• Phase 1 and Phase 2 selectors are invoked by the policy itself.
• Less flexible, not recommended for modern deployments.

Configuration Steps:

• Define Phase 1 and Phase 2 as non-interface based.
• Create a policy with action ipsec.
• Define source, destination, and services in the policy.

Use Case:

• Simple point-to-point connections with fixed policies and no dynamic routing.

Comparison Table:

Feature	Route-Based VPN	Policy-Based VPN
Interface Created	Yes (e.g., vpn-to-siteA)	No
Routing Method	Static/dynamic routes	Policy-defined
Flexibility	High	Low
Modern Best Practice	Yes	No
Fortinet Exam Coverage	Frequently tested	Frequently tested

2. IPsec VPN Diagnostics – CLI Troubleshooting Commands

View Phase 1 Tunnel Status:

diagnose vpn ike gateway list

• Displays tunnel name, status, remote IP, and current phase 1 status.

View Phase 2 Security Associations:

get vpn ipsec tunnel details

• Shows encryption details, selectors, byte counters, and tunnel uptime.

Debug IKE Negotiation:

diagnose debug application ike -1
diagnose debug enable

• Enables verbose output for Phase 1 and Phase 2 negotiations.
• Use with caution in production—can generate large outputs.

Stop Debugging:

diagnose debug reset

Exam Tip:

You may encounter a question like:

“You configured a VPN tunnel, but traffic is not passing. Which command helps verify Phase 2 selectors?”

Correct answer: get vpn ipsec tunnel details

3. SSL VPN Split Tunneling

What Is Split Tunneling?

Split tunneling allows only specified traffic (e.g., internal subnet 10.0.0.0/24) to go through the SSL VPN tunnel, while all other traffic (e.g., general internet access) stays local.

Why Use It?

• Reduces load on the FortiGate VPN gateway.
• Improves internet performance for remote users.
• Enhances security by limiting VPN access scope.

How to Enable:

config vpn ssl web portal
    edit "tunnel-access"
        set tunnel-mode enable
        set split-tunneling enable
        set ip-pools "SSLVPN_TUNNEL_ADDR1"
        set split-tunneling-routing-address "LAN-SUBNET"
    next
end

• Ensure that your firewall policy only allows specific subnets for split tunneling.

4. SSL VPN Security Best Practices

To secure remote access via SSL VPN, Fortinet recommends several hardening techniques, which are also commonly tested in the exam.

1. Enforce Two-Factor Authentication (2FA):

• Add a second authentication factor (e.g., FortiToken or external RADIUS with OTP).
• Applied via user group settings.

2. Block Access to Local Subnets (Prevent VPN Pivoting):

• Prevent connected SSL VPN users from accessing their local subnet.
• Achieved by modifying the split tunneling settings or using deny policies.

3. Limit Access to Internal Resources:

• Use address groups or firewall policies to restrict SSL VPN users to only the necessary services or subnets.

4. Use Secure TLS Settings:

• Disable legacy TLS versions (TLS 1.0 / 1.1).
• Use strong ciphers only.

5. Regularly Rotate Certificates and Keys:

• Avoid long-term self-signed certificates.
• Ensure VPN servers use up-to-date, trusted certificates.

Summary Table:

Topic	Key Point
Route-based vs Policy-based VPN	Route-based preferred; policy-based is legacy but still exam-tested
IPsec VPN Diagnostics	Use CLI to verify Phase 1/2 status and troubleshoot negotiation issues
SSL VPN Split Tunneling	Allows partial traffic to go through VPN while keeping local access open
SSL VPN Security Best Practices	2FA, access restriction, local subnet block, TLS hardening