Introduction

Virtual Private Networks (VPNs) are an essential part of modern network infrastructure. This guide focuses on how to set up an IPSec VPN between Cisco and Fortigate devices, specifically the Cisco C1000 Router Series and a Fortigate Firewall. This tutorial is aimed at network engineers, IT professionals, and anyone interested in establishing a secure VPN connection.

Note: This tutorial assumes that you have basic knowledge of networking and are familiar with the Command Line Interface (CLI) of both Cisco and Fortigate devices.

Prerequisites for IPSec VPN between Cisco and Fortigate

• Cisco C1000 Router with IOS
• Fortigate Firewall Device
• Administrative access to both devices
• Basic networking knowledge

Topology Overview

Before diving into the configuration of an IPSec VPN between Cisco and FortiGate, let’s take a look at the network topology that we’ll be working with.

Models and Firmware Used in This Example

For this guide, we’ll be using a Cisco C1000 router, specifically the C1121-4P model. However, the configurations should be applicable to most Cisco routers running the IOS XE firmware.

Similarly, for Fortigate, this guide was tested with an FGT100F running on firmware 7.2. Most of the CLI configurations should be applicable to other Fortigate devices and firmware versions.

Deep-dive into the configuration

Step 1: Access the Router

First, access the Cisco C1000 router via SSH or console cable.

Step 2: Enable IPSec and Define Phase 1 Settings

crypto isakmp policy 1
  encryption aes 256
  hash sha256
  authentication pre-share
  group 14

Step 3: Adding Crypto Pre-shared Key

crypto isakmp key Password123 address 10.20.1.20
 

Step 4: Define Phase 2 Settings

crypto ipsec transform-set transform1 esp-aes 256 esp-sha-hmac
  mode tunnel

Step 5: Create IPSec Profile

crypto ipsec profile FG set transform-set transform1  set pfs group14

Step 6: Creating Crypto Map

crypto map C1121-test 1 ipsec-isakmp
  set peer 10.20.1.20
  set transform-set transform1
  set pfs group14
  match address 101
  crypto map C1121-test

Step 7: Applying Crypto Map to Interface

interface GigabitEthernet0/0/0
  ip address 10.10.1.10 255.255.255.252
  crypto map C1121-test
 

Step 8: Creating ACL for local subnet

ip access-list extended 101
10 permit ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255

Step 9: Save Configuration

write memory 

Fortigate Configuration

Step 1: Access the Fortigate Firewall

Step 2: Define Phase 1 Settings

config vpn ipsec phase1-interface edit "to_Cisco"  set interface "wan1"  set keylife 86400  set peertype any  set proposal aes128-sha1 next 

Step 3: Define Phase 2 Settings

config vpn ipsec phase2-interface edit "to_Cisco_Phase2"  set phase1name "to_Cisco"  set proposal aes128-sha1 next 

Step 4: Apply Policies and Routes

config firewall policy edit 1  set srcintf "lan"  set dstintf "wan1"  set srcaddr "all"  set dstaddr "all"  set action ipsec  set phase1name "to_Cisco" next

Step 5: Save Configuration

execute cfg save

Verification

Cisco Verification

show crypto isakmp sa show crypto ipsec sa 

Fortigate Verification

diagnose vpn tunnel list

Troubleshooting

1. Check Logs: show log on Cisco and diagnose debug on Fortigate.
2. Phase 1 and Phase 2 Mismatches: Ensure settings match.
3. Routing Issues: Verify routes.

Conclusion

Setting up an IPSec VPN between a Cisco C1000 Router and a Fortigate Firewall is straightforward with this guide. Always verify your configurations and consult logs for troubleshooting.

Additional Resources

For those interested in diving deeper into the topic of setting up an IPSec VPN between Cisco and Fortigate devices, you can refer to this in-depth guide: Configuration Example: IPsec VPN between a FortiGate unit and Cisco. This resource provides a comprehensive look at VPN setup using a Virtual Tunnel Interface (VTI) on the Cisco router and covers the IPsec configuration using a Pre-Shared Key for security.

Related Articles on awalhakim.com

If you found this guide on setting up an IPSec VPN between Cisco C1000 and Fortigate useful, you might also be interested in exploring other networking topics. Check out our article on Understanding Juniper Firmware in Junos EX Switches. This article provides insights into Juniper firmware, offering a different perspective on network device management.