xrcd2 網路小頑童: 2025

2025年7月5日星期六

OSPF over IPsec gre tunnel in FortiGat

Continuing this theme, this time it’s a site-to-site VPN between FTGs

https://xrcd2.blogspot.com/2025/07/fortigate-site-to-site-vpn-lab.html

https://xrcd2.blogspot.com/2023/02/ospf-over-ipsec-for-paloalto-and.html

CLI config example

(1)

FortiGate-BH (VPN-TO-HQ) # show

config vpn ipsec phase1-interface

edit "VPN-TO-HQ"

set interface "port1"

set local-gw 68.10.1.1

set peertype any

set net-device disable

set proposal des-md5 des-sha1

set dhgrp 14 5

set encapsulation gre

set remote-gw 210.10.1.1

set psksecret FortiPWD168

end

FortiGate-BH (VPN-TO-HQ) # show

config vpn ipsec phase2-interface

edit "VPN-TO-HQ"

set phase1name "VPN-TO-HQ"

set proposal des-md5 des-sha1

set dhgrp 14 5

set auto-negotiate enable

set encapsulation transport-mode

set protocol 47

end

FortiGate-BH (VPN-TO-HQ) # show

config system interface

edit "VPN-TO-HQ"

set vdom "root"

set ip 192.168.1.2 255.255.255.255

set allowaccess ping

set type tunnel

set remote-ip 192.168.1.1 255.255.255.252

set snmp-index 15

set interface "port1"

end

================================================

(2)

FortiGate-HQ (VPN-TO-BH) # show

config vpn ipsec phase1-interface

edit "VPN-TO-BH"

set interface "port1"

set local-gw 210.10.1.1

set peertype any

set net-device disable

set proposal des-md5 des-sha1

set dhgrp 14 5

set encapsulation gre

set remote-gw 68.10.1.1

set psksecret FortiPWD168

end

FortiGate-HQ (VPN-TO-BH) # show

config vpn ipsec phase2-interface

edit "VPN-TO-BH"

set phase1name "VPN-TO-BH"

set proposal des-md5 des-sha1

set dhgrp 14 5

set auto-negotiate enable

set encapsulation transport-mode

set protocol 47

end

FortiGate-HQ (VPN-TO-BH) # show

config system interface

edit "VPN-TO-BH"

set vdom "root"

set ip 192.168.1.1 255.255.255.255

set allowaccess ping

set type tunnel

set remote-ip 192.168.1.2 255.255.255.252

set snmp-index 15

set interface "port1"

end

===================================================

WEB config example

========================================

Tracer & Ping Test

2025年7月4日星期五

FortiGate Site to Site VPN Lab

Continuing this theme, this time it’s a site-to-site VPN between FTGs

https://xrcd2.blogspot.com/2023/02/ospf-over-ipsec-for-paloalto-and.html

2025年6月27日星期五

FortiGate firewall configures the Syslog filter

Reference URL :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-syslog-free-style-filters/ta-p/204606

Test

Log Example:

ssh login

Jun 28 14:06:00 192.168.100.254 date=2025-06-28 time=14:06:00 devname="Test-FW" devid="FGVMEXXXXXXXXXXX" eventtime=1751090760672765479 tz="+0800" logid="0100032001" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="1751090760" user="admin" ui="ssh(192.168.100.112)" method="ssh" srcip=192.168.100.112 dstip=192.168.100.254 action="login" status="success" reason="none" profile="super_admin" msg="Administrator admin logged in successfully from ssh(192.168.100.112)"

web login

Jun 28 14:07:10 192.168.100.254 date=2025-06-28 time=14:07:09 devname="Test-FW" devid="FGVMEXXXXXXXXXXX" eventtime=1751090829377377416 tz="+0800" logid="0100032001" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="1751090829" user="admin" ui="http(192.168.100.112)" method="http" srcip=192.168.100.112 dstip=192.168.100.254 action="login" status="success" reason="none" profile="super_admin" msg="Administrator admin logged in successfully from http(192.168.100.112)"

=======================================================

ssh config

Jun 28 13:48:30 192.168.100.254 date=2025-06-28 time=13:48:30 devname="Test-FW01" devid="FGVMEXXXXXXXXXXX" eventtime=1751089710571156282 tz="+0800" logid="0100032102" type="event" subtype="system" level="alert" vd="root" logdesc="Configuration changed" user="admin" ui="ssh(192.168.100.112)" msg="Configuration is changed in the admin session"

web config

Jun 28 13:58:07 192.168.100.254 date=2025-06-28 time=13:58:07 devname="Test-FW" devid="FGVMEXXXXXXXXXXX" eventtime=1751090286557611095 tz="+0800" logid="0100032222" type="event" subtype="system" level="notice" vd="root" logdesc="Global setting changed" user="admin" ui="GUI(192.168.100.112)" field="hostname" old_value="Test-FW01" new_value="Test-FW" msg="User admin changed hostname global setting to Test-FW from GUI(192.168.100.112)"

==================================================

FTG Config

Test-FW # config log syslogd filter

Test-FW (filter) # show

config log syslogd filter

config free-style

edit 1

set category event

set filter "logid 0100032001 0100032102 0100032222"

edit 2

set category traffic

set filter "srcintf port1"