Chapter 10- Cloud Technologies

10-1 IPSEC VPN from FortiGate (on premise) to Azure

Learning Objectives

  • Configure a Virtual Network Gateway in Azure
  • Configure a local network gateway
  • Create an IPSEC VPN between Firewall on-Premise and Azure
Scenario: We are going to connect on premise FortiGate to Azure Virtual Gateway. This is going to be IPSEC VPN between FortiGate and Azure. First, we will configure Azure and then connect FortiGate through Port1 to Azure Virtual Gateway.
main scenario IPSEC VPN from FortiGate (on premise) to Azure
Figure 10-1: main scenario
Table 10-1: On-premise devices configuration
Device Configuration Access
FortiGate Port 1: DHCP Client

Port 2: 192.168.10.1/24

 Port1: HTTP, HTTPS, PING

 
 WebTerm-1 192.168.10.2/24 –

Azure Configuration

  1. Create a resource group in Azure as following:
    • Resource group : FG
    • Region: West US
Step1-Create a resource group
Figure 10-2: Step1-Create a resource group

 

Step 2- create a resource group
Figure 10-3: Step 2- create a resource group
Step3- create a resource group
Figure 10-4: Step3- create a resource group

 

2. Create a virtual network as following:

  • Resource group: FG
  • Name: Azure-FG
  • Region : West US
  • Change the default subnet: 10.0.1.0/24
Step1- create a virtual network
Figure 10-5: Step1- create a virtual network

 

Step2- create a virtual network(Change default subnet)
Figure 10-6: Step2- create a virtual network(Change default subnet)

 

Step3- create a virtual network
Figure 10-7: Step3- create a virtual network

 

Step4- create a virtual network - Creating a Tag
Figure 10-8: Step4- create a virtual network

 

Step5- create a virtual network "Review + Create"
Figure 10-9: Step5- create a virtual network

3. Create a virtual network gateway as following:

  • Name: Azure-VPN-FG
  • Region: West US
  • Generation: Generation1
  • Gateway subnet address range: 10.0.0.0/24
  • Public IP address name: AzurePublic

Click on “Create and Review”. It takes around 25 minutes to deploy a virtual network gateway in Azure.

Step1- create a virtual network gateway
Figure 10-10: Step1- create a virtual network gateway

 

Step 2- create a virtual network gateway
Figure 10-11: Step 2- create a virtual network gateway

 

Step3- create a virtual network gateway - Gateway subnet and Public IP address
Figure 10-12: Step3- create a virtual network gateway

 

Step 4- create a virtual network gateway (review + create)
Figure 10-13: Step 4- create a virtual network gateway (review + create)

 

Step 5- create a virtual network gateway( Deployment)
Figure 10-14: Step 5- create a virtual network gateway( Deployment)

 

Step 6- Deployment of virtual network gateway
Figure 10-15: Step 6- Deployment of virtual network gateway

 

4. Create a local network gateway as following:

  • Resource Group: FG
  • Region: West US
  • Name: FortiGate
  • IP Address: IP_Address_of_Port1_FortiGate(On premise)
  • Address Space: IP_Address_LocalNetwork
Step 1- create a local network gateway
Figure 10-16: Step 1- create a local network gateway

 

Step 2- create a local network gateway- IP Address, Region and Name
Figure 10-17: Step 2- create a local network gateway

 

Step 3- create a local network gateway (review + create)
Figure 10-18: Step 3- create a local network gateway (review + create)

 

Step 4- Verify local network gateway deployment
Figure 10-19: Step 4- Verify local network gateway deployment

5. Go to Virtual network gateway and create a connection in Virtual network gateways> connections> Add:

Add connections
Figure 10-20: Step 1- Add connections

 

Step 2- Connection configuration
Figure 10-21: Step 2- Connection configuration

Based on Micorosft document by default integrity is SHA384, SHA256, SHA1, MD5 and encryption is AES256, AES192, AES128, DES3, DES. So, we will select SHA1 and AES128 in FortiGate. After doing this step, you should receive a Public IP address in Overview tab.

Step 3- Verify public IP address
Figure 10-22: Step 3- Verify public IP address

FortiGate Configuration

  1. First, we will configure port 2 IP address.
Set an IP address for port2
Figure 10-23: Set an IP address for port2
Por1 and Port2 IP addresses
Figure 10-24: Por1 and Port2 IP addresses

2. Create a static route to port1(WAN Port) as Figure 10-25.

Create a static route to port1(WAN Port)
Figure 10-25: Create a static route

3. Create a IPSEC Wizard as a custom

Create a IPSEC Wizard as a custom
Figure 10-26: Step1- Create a custom VPN
  • Remote Gateway IP Address: Public_IP_Address_Azure_Virtual_Gateway
  • Nat Traversal : Disable
  • Pre-shared Key: The same as Azure key(123456789)
  • Local Address: 192.168.10.0/24
  • Remote Address: 10.0.0.0/16
  • Phase 1: Encryption : AES128, Authentication: SHA-1, DH: 2, lifetime: 28800
  • Phase 2: Encryption : AES128, Authentication: SHA-1, DH: 2, lifetime: 27000
Step 2- Create a custom VPN
Figure 10-27: Step 2- Create a custom VPN
Step 3- Create a custom VPN
Figure 10-28: Step 3- Create a custom VPN
Step 4- Create a custom VPN
Figure 10-29: Step 4- Create a custom VPN

4. Create a firewall policy from Port 2 to Tunnel and from Tunnel to Port2. We will create a subnet for LAN on premise and a subnet for Microsoft Azure. Like site-to-site VPN we learned previously, NAT should be disabled here.

Create a subnet for local network
Figure 10-30: Create a subnet for local network
Create a subnet for Azure local
Figure 10-31: Create a subnet for Azure local
Create a policy from port2 to FG-Azure Tunnel
Figure 10-32: Create a policy from port2 to FG-Azure Tunnel
Create a policy from FG-Azure Tunnel to port2
Figure 10-33: Create a policy from FG-Azure Tunnel to port2
Create a policy from FG-Azure Tunnel to port2
Figure 10-34: Create a policy from FG-Azure Tunnel to port2
List of Firewall Policies
Figure 10-35: Firewall Policies

Verify connections

if you navigate to IPSEC Tunnel, the status should be up.

Verify status in FortiGate
Figure 10-36: Verify status in FortiGate
Verify status in Azure
Figure 10-37: Verify status in Azure

 

 

 

License

Icon for the Creative Commons Attribution 4.0 International License

FortiGate Firewall: Practical Guidance and Hands-On Labs by Hamid Talebi is licensed under a Creative Commons Attribution 4.0 International License, except where otherwise noted.

Share This Book