Adding source and destination subnets to IPsec VPN phase 2 configurations in Fortigate

 Thanks to: https://docs.fortinet.com/

FortiGate-7000 IPsec VPNs require phase 2 selectors. The phase 2 selectors specify the IP addresses and netmasks of the source and destination subnets of the VPN. The phase 2 selectors are mandatory on the FortiGate-7000 and are used to make sure that all IPsec VPN traffic is sent to the primary (master) FPM.

Use the following command to add phase 2 selectors.

config vpn ipsec phase2-interface

edit "to_fgt2"

set phase1name <name>

set src-subnet <IP> <netmask>

set dst-subnet <IP> <netmask>

end

Where

src-subnet the subnet protected by the FortiGate that you are configuring and from which users connect to the destination subnet.

dst-subnet the destination subnet behind the remote IPsec VPN endpoint.

Example basic IPsec VPN phase 2 configuration

In a simple configuration such as the one below with an IPsec VPN between two remote subnets you can add the phase 2 selectors by adding the subnets to the phase 2 configuration as shown.

Enter the following command to add the source and destination subnets phase 2 selectors to the FortiGate-7000 IPsec VPN Phase 2 configuration.

config vpn ipsec phase2-interface

edit "to_fgt2"So

set phase1name "to_fgt2"

set src-subnet 172.16.1.0 255.255.255.0

set dst-subnet 172.16.2.0 255.255.255.0

end

Example multiple subnet IPsec VPN phase 2 configuration

In a more complex configuration, such as the one below with a total of 5 subnets you still need to use the phase 2 selectors to add all of the subnets to the Phase 2 configuration. In this case you can create a firewall address for each subnet, add the addresses to address groups, and add the address groups to the phase 2 selectors.

Enter the following commands to create firewall addresses for each subnet.

config firewall address

edit "local_subnet_1"

set subnet 4.2.1.0 255.255.255.0

next

edit "local_subnet_2"

set subnet 4.2.2.0 255.255.255.0

next

edit "remote_subnet_3"

set subnet 4.2.3.0 255.255.255.0

next

edit "remote_subnet_4"

set subnet 4.2.4.0 255.255.255.0

next

edit "remote_subnet_5"

set subnet 4.2.5.0 255.255.255.0

end

And then put the five firewall addresses into two firewall address groups.

config firewall addrgrp

edit "local_group"

set member "local_subnet_1" "local_subnet_2"

next

edit "remote_group"

set member "remote_subnet_3" "remote_subnet_4" "remote_subnet_5"

end

Now, use the firewall address groups in the Phase 2 configuration:

config vpn ipsec phase2-interface

edit "to-fgt2"

set phase1name "to-fgt2"

set src-addr-type name

set dst-addr-type name

set src-name "local_group"

set dst-name "remote_group"

end