How to configure IPsec VPN between Fortinet and Sophos Firewall

 

Thank to: https://ictfella.com/

This post is to document the process to configure static IPsec VPN between Fortinet and Sophos Firewall.

Environment

• 1x Fortinet Fortigate Firewall cluster running at active-passive mode
• 1x Sophos UTM Firewall
• Both sides have static public IP assigned
• Phase 1 and Phase 2 use the same encryption (AES256) and authentication (SHA256) algorithm, Group 14 or Group 5 are selected for the Diffie-hellman process.

Configure Fortigate firewall

Go to “VPN” – “IPsec Wizard”, start the new VPN wizard, give it a sensible name and choose “Custom” as the template type

Give it a name, choose “static IP address” in Remote Gateway, put Site b public IP address in and choose your “WAN” port as the source interface

In the Authentication and Phase1 Proposal section, we have chosen

1. Pre-Shared Key
2. IKE V1
3. Main (ID protection) mode
4. AES256 for Encryption and SHA256 for Authentication
5. Diffie-Hellman Groups 14 and 5
6. Key lifetime: 86400 seconds
7. XAuth: disabled

In Phase 2 Selectors, we have defined the local and remote subnets, the same encryption and authentication for the phase2 proposal:

Add a new route to go to Site B subnet:

Add needed policy on both ways to allow the inter-site traffic, please make sure NAT is disabled for inter-site traffic

Sophos UTM Firewall

In the “Remote Gateway” tab, add a new remote gateway to march up the Fortigate firewall configuration

In the “Policies” tab, add a new IPsec Policy to match up the Fortigate firewall configuration

In the “Connection” tab, link the remote gateways and policies together, make sure the new IPsec connection is switched on.

Bring up the IPsec interface in the Fortigate firewall

Go to the “Dashboard” – “Network” -“IPsec” widget, you can see your IPsec interface status

If you want to manually bring up the IPsec interface, click into the widget and bring it up

Useful links

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/791718/ipsec-vpn-from-the-gui