说明：如果要删除IPSEC VPN第一阶段、第二阶段时，需要先删除被调用的路由与防火墙安全策略。

四、配置步骤

1、配置FortiGate

1) 基本上网配置

2) 配置IPsec VPN

进入：虚拟专网--IPSEC隧道--"新建"

选择IPsec VPN自定义模板进行配置：

IPsec 第一阶段配置：

IPsec 第二阶段配置：

命令行：

config vpn ipsec phase1-interface
edit "VPN-TO-Side1"
set interface "port1"
set ike-version 2
set peertype any
set proposal 3des-md5 aes128-sha1
set dpd on-idle
set remote-gw 101.100.1.1
set psksecret Fortinet123#
next
end
config vpn ipsec phase2-interface
edit "VPN-TO-Side1"
set phase1name "VPN-TO-Side1"
set proposal 3des-md5 aes128-sha1
set auto-negotiate enable
next

end

将IPsec的隧道上配置IP地址，用于和Cisco进行tunnel的对接：

config system interface

edit "VPN-TO-Side1"

set ip 1.1.1.1 255.255.255.255

set remote-ip 1.1.1.2 255.255.255.0

set allowaccess ping

end

3) 配置VPN相关的策略

命令行：

配置防火墙策略：
config firewall address
edit "Local_192.168.111.0/24"
set allow-routing enable
set subnet 192.168.111.0 255.255.255.0
next
edit "Remote_192.168.112.0/24"
set allow-routing enable
set subnet 192.168.112.0 255.255.255.0
next

end

  config firewall policy
							
    edit 1
							
        set name "TO-Internet"         //内网上互联网的策略
							
        set srcintf "port2"
							
        set dstintf "port1"
							
        set srcaddr "all"
							
        set dstaddr "all"
							
        set action accept
							
        set schedule "always"
							
        set service "ALL"
							
        set fsso disable
							
        set nat enable
							
    next
							
    edit 2
							
        set name "VPN-TO-Side1"
							
        set srcintf "port2"
							
        set dstintf "VPN-TO-Side1"
							
        set srcaddr "Local_192.168.111.0/24"
							
        set dstaddr "Remote_192.168.112.0/24"
							
        set action accept
							
        set schedule "always"
							
        set service "ALL"
							
        set fsso disable
							
    next
							
    edit 3
							
        set name "VPN-Side1-TO-Local"
							
        set srcintf "VPN-TO-Side1"
							
        set dstintf "port2"
							
        set srcaddr "Remote_192.168.112.0/24"
							
        set dstaddr "Local_192.168.111.0/24"
							
        set action accept
							
        set schedule "always"
							
        set service "ALL"
							
        set fsso disable
							
    next
							
   end

4）配置VPN业务网段的静态路由

命令行：

config router static
edit 1
set gateway 202.106.1.254
set device "port1"
next
edit 2
set dst 192.168.112.0 255.255.255.0
set device "VPN-TO-Side1"
next
edit 3
set dst 192.168.112.0 255.255.255.0
set distance 254
set blackhole enable
next

end

----FortiGate的配置全部完成----

2、配置Cisco ASA防火墙

1) 基本上网配置

interface GigabitEthernet0/0

nameif Outside

security-level 0

ip address 101.100.1.1 255.255.255.0

interface GigabitEthernet0/1

nameif Inside

security-level 100

ip address 192.168.112.1 255.255.255.0

route Outside 0.0.0.0 0.0.0.0 101.100.1.254

object network Inside_Net_192.168.112.0

subnet 192.168.112.0 255.255.255.0

object network Inside_Net_192.168.112.0

nat (Inside,Outside) dynamic interface

policy-map global_policy

class inspection_default

inspect icmp

inspect icmp error

2) IPsec IKE v2的配置

crypto ikev2 enable Outside

 crypto ikev2 policy 10
												
  encryption aes-256 aes-192 aes 3des
												
  integrity sha256 sha md5
												
  group 14 5
												
  prf sha256 sha md5
												
  lifetime seconds 86400
												
 !

 tunnel-group 202.106.1.1 type ipsec-l2l
												
 tunnel-group 202.106.1.1 ipsec-attributes
												
  ikev2 remote-authentication pre-shared-key Fortinet123#
												
  ikev2 local-authentication pre-shared-key Fortinet123#
												
 !

 crypto ipsec ikev2 ipsec-proposal MY_IPsec_Proposal
												
  protocol esp encryption aes-256 aes-192 aes 3des
												
  protocol esp integrity sha-256 sha-1 md5
												
 crypto ipsec profile MY_IPsec_Profile
													
  set ikev2 ipsec-proposal MY_IPsec_Proposal
													
  set pfs group5

interface Tunnel0

nameif VPN

ip address 1.1.1.2 255.255.255.0

tunnel source interface Outside

tunnel destination 202.106.1.1

tunnel mode ipsec ipv4

tunnel protection ipsec profile MY_IPsec_Pro

management-access Inside //为了可以让Inside接口可以被ping通。

route VPN 192.168.111.0 255.255.255.0 1.1.1.1

ASA-FW(config)# show version

Cisco Adaptive Security Appliance Software Version 9.9(2)

Firepower Extensible Operating System Version 2.3(1.84)

Device Manager Version 7.9(2)

Compiled on Sun 25-Mar-18 17:32 PDT by builders

System image file is "boot:/asa992-smp-k8.bin"

Config file at boot was "startup-config"

----Cisco_ASA防火墙的配置全部完成----

五、检查配置结果

VPN状态查看：

查看VPN监视器，观察状态：进入"监视器"--"IPsec监测"

路由状态查看：

FortiGate侧业务测试：

Center # execute ping-options source 192.168.111.1

Center #
Center # execute ping 192.168.112.1
PING 192.168.112.1 (192.168.112.1): 56 data bytes
64 bytes from 192.168.112.1: icmp_seq=0 ttl=255 time=2.0 ms
64 bytes from 192.168.112.1: icmp_seq=1 ttl=255 time=1.7 ms
64 bytes from 192.168.112.1: icmp_seq=2 ttl=255 time=2.4 ms
64 bytes from 192.168.112.1: icmp_seq=3 ttl=255 time=1.9 ms
64 bytes from 192.168.112.1: icmp_seq=4 ttl=255 time=1.6 ms

--- 192.168.112.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 1.6/1.9/2.4 ms

Center # execute ping 192.168.112.100
PING 192.168.112.100 (192.168.112.100): 56 data bytes
64 bytes from 192.168.112.100: icmp_seq=0 ttl=64 time=3.0 ms
64 bytes from 192.168.112.100: icmp_seq=1 ttl=64 time=1.6 ms
64 bytes from 192.168.112.100: icmp_seq=2 ttl=64 time=1.9 ms
64 bytes from 192.168.112.100: icmp_seq=3 ttl=64 time=1.7 ms
64 bytes from 192.168.112.100: icmp_seq=4 ttl=64 time=2.7 ms

--- 192.168.112.100 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 1.6/2.1/3.0 ms

Center #

Center # get router info routing-table all

Routing table for VRF=0
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

S* 0.0.0.0/0 [10/0] via 202.106.1.254, port1
C    1.1.1.0/24 is directly connected, VPN-TO-Side1
C    1.1.1.1/32 is directly connected, VPN-TO-Side1
C    192.168.111.0/24 is directly connected, port2
S    192.168.112.0/24 [10/0] via 1.1.1.2, VPN-TO-Side1
C    202.106.1.0/24 is directly connected, port1

Center # get vpn ike gateway

vd: root/0
name: VPN-TO-Side1
version: 2
interface: port1 3
addr: 202.106.1.1:500 -> 101.100.1.1:500
created: 576s ago
IKE SA created: 1/3 established: 1/3 time: 0/33/90 ms
IPsec SA created: 1/3 established: 1/3 time: 0/3/10 ms

id/spi: 729 16ffc8effd2e0595/752b881ed313b425
direction: responder
status: established 535-535s ago = 0ms
proposal: aes-128-sha256
SK_ei: 70d90f744193f413-0f49bb79f001a3d3
SK_er: 39d4799b4d594363-7daf6cd6977c06cc
SK_ai: e92c8d0072fb3628-2de5e7a702ab2886-22e7ac7d5a95140a-853eb8592cc449c6
SK_ar: 12243c043d9b5f11-14212fd6f6a91b96-61f52760353cc185-31ed4a3836b2b314
lifetime/rekey: 86400/85594
DPD sent/recv: 00000000/00000000

Center # get vpn ipsec tunnel details

gateway
name: 'VPN-TO-Side1'
type: route-based
local-gateway: 202.106.1.1:0 (static)
remote-gateway: 101.100.1.1:0 (static)
  mode: ike-v2
interface: 'port1' (3)
rx packets: 40 bytes: 5440 errors: 0
tx packets: 40 bytes: 3360 errors: 0
dpd: on-idle/negotiated idle: 20000ms retry: 3 count: 0
selectors
name: 'VPN-TO-Side1'
auto-negotiate: enable
mode: tunnel
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
SA
lifetime/rekey: 43200/42385
mtu: 1446
tx-esp-seq: 29
replay: enabled
inbound
spi: ff0ec647
enc: 3des 2d5f828e6b36aa1ece211ad70a5b3b3377fc5a88000562b9
auth: md5 15540d20fb79c457637898129b76b87e
outbound
spi: 442bdf66
enc: 3des 301f7e397b596b1cee5d2d9d1c5d03d750118d514a1e51dc
auth: md5 27a2e6ec5fff5c1e8d22135258f35b07

Center #

Cisco_ASA侧业务测试：

ASA-FW# ping inside 192.168.111.1 repeat 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.111.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/10 ms
ASA-FW#
ASA-FW# ping inside 192.168.111.100 repeat 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.111.100, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/10 ms
ASA-FW#

ASA-FW# show crypto ikev2 sa

IKEv2 SAs:

Session-id:3, Status:UP-ACTIVE, IKE count:1, CHILD count:1

Tunnel-id Local    Remote Status    Role
362695251 101.100.1.1/500    202.106.1.1/500 READY INITIATOR
Encr: AES-CBC, keysize: 128, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/943 sec
Child sa: local selector 0.0.0.0/0 - 255.255.255.255/65535
remote selector 0.0.0.0/0 - 255.255.255.255/65535
ESP spi in/out: 0x442bdf66/0xff0ec647
ASA-FW#

ASA-FW# show crypto ipsec sa
interface: VPN
Crypto map tag: __vti-crypto-map-4-0-0, seq num: 65280, local addr: 101.100.1.1

local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer: 202.106.1.1

#pkts encaps: 262, #pkts encrypt: 262, #pkts digest: 262
#pkts decaps: 262, #pkts decrypt: 262, #pkts verify: 262
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 262, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: 101.100.1.1/500, remote crypto endpt.: 202.106.1.1/500
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: FF0EC647
current inbound spi : 442BDF66

inbound esp sas:
spi: 0x442BDF66 (1143725926)
SA State: active
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 5, IKEv2, VTI, }
slot: 0, conn_id: 62, crypto-map: __vti-crypto-map-4-0-0
sa timing: remaining key lifetime (kB/sec): (4055015/27840)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0xFF0EC647 (4279158343)
SA State: active
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 5, IKEv2, VTI, }
slot: 0, conn_id: 62, crypto-map: __vti-crypto-map-4-0-0
sa timing: remaining key lifetime (kB/sec): (4285415/27840)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

ASA-FW#

抓包：
Center # dia sni pa any "host 192.168.112.100 or host 101.100.1.1" 4 0 a
interfaces=[any]
filters=[host 192.168.112.100 or host 101.100.1.1]
2019-03-28 15:51:37.940323 port2 in 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:37.940391 VPN-TO-Side1 out 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:37.940416 port1 out 202.106.1.1 -> 101.100.1.1: ESP(spi=0x442bdf66,seq=0x108)
2019-03-28 15:51:37.941789 port1 in 101.100.1.1 -> 202.106.1.1: ESP(spi=0xff0ec647,seq=0x107)
2019-03-28 15:51:37.941803 VPN-TO-Side1 in 192.168.112.100 -> 192.168.111.100: icmp: echo reply
2019-03-28 15:51:37.942012 port2 out 192.168.112.100 -> 192.168.111.100: icmp: echo reply

2019-03-28 15:51:38.942566 port2 in 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:38.942617 VPN-TO-Side1 out 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:38.942639 port1 out 202.106.1.1 -> 101.100.1.1: ESP(spi=0x442bdf66,seq=0x109)
2019-03-28 15:51:38.943962 port1 in 101.100.1.1 -> 202.106.1.1: ESP(spi=0xff0ec647,seq=0x108)
2019-03-28 15:51:38.943976 VPN-TO-Side1 in 192.168.112.100 -> 192.168.111.100: icmp: echo reply
2019-03-28 15:51:38.943986 port2 out 192.168.112.100 -> 192.168.111.100: icmp: echo reply

2019-03-28 15:51:39.944764 port2 in 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:39.944819 VPN-TO-Side1 out 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:39.944840 port1 out 202.106.1.1 -> 101.100.1.1: ESP(spi=0x442bdf66,seq=0x10a)
2019-03-28 15:51:39.946850 port1 in 101.100.1.1 -> 202.106.1.1: ESP(spi=0xff0ec647,seq=0x109)
2019-03-28 15:51:39.946862 VPN-TO-Side1 in 192.168.112.100 -> 192.168.111.100: icmp: echo reply
2019-03-28 15:51:39.946872 port2 out 192.168.112.100 -> 192.168.111.100: icmp: echo reply

2019-03-28 15:51:40.948097 port2 in 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:40.948152 VPN-TO-Side1 out 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:40.948174 port1 out 202.106.1.1 -> 101.100.1.1: ESP(spi=0x442bdf66,seq=0x10b)
2019-03-28 15:51:40.950294 port1 in 101.100.1.1 -> 202.106.1.1: ESP(spi=0xff0ec647,seq=0x10a)
2019-03-28 15:51:40.950307 VPN-TO-Side1 in 192.168.112.100 -> 192.168.111.100: icmp: echo reply
2019-03-28 15:51:40.950316 port2 out 192.168.112.100 -> 192.168.111.100: icmp: echo reply

2019-03-28 15:51:41.951394 port2 in 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:41.951459 VPN-TO-Side1 out 192.168.111.100 -> 192.168.112.100: icmp: echo request
2019-03-28 15:51:41.951481 port1 out 202.106.1.1 -> 101.100.1.1: ESP(spi=0x442bdf66,seq=0x10c)
2019-03-28 15:51:41.953641 port1 in 101.100.1.1 -> 202.106.1.1: ESP(spi=0xff0ec647,seq=0x10b)
2019-03-28 15:51:41.953655 VPN-TO-Side1 in 192.168.112.100 -> 192.168.111.100: icmp: echo reply
2019-03-28 15:51:41.953665 port2 out 192.168.112.100 -> 192.168.111.100: icmp: echo reply
^C
32 packets received by filter
0 packets dropped by kernel

Center #

说明：关于sniffer抓VPN业务和ESP的包
抓取IPsec VPN的IKE协商包：
diagnose sniffer packet any "host 101.1.1.1 and (port 500 or port 4500)" 4

抓取IPsec VPN的ESP加密数据包：
diagnose sniffer packet any "host 101.1.1.1 and esp" 4

抓取IPsec VPN的明文业务数据包：
diagnose sniffer packet any "host 192.168.112.100 and icmp" 4

注意：由于存在IPsec VPN芯片加速，因此可能数据包会抓不完全，主要指“ESP数据和明文业务数据”抓不全，因此有时候需要将VPN隧道的NP加速关闭：
FortiGate1_BeiJing # config vpn ipsec phase1-interface
FortiGate1_BeiJing (phase1-interface) # edit BJ-OSPF-TO-SH
FortiGate1_BeiJing (BJ-OSPF-TO-SH) # set npu-offload disable
FortiGate1_BeiJing (BJ-OSPF-TO-SH) # end

附：Cisco ASA IPsec VPN 传统的Crypto MAP的配置方式（上述为VTI方式的IPsec VPN）：

FortiGate 只需要修改IPsec VPN的第二阶段（添加明确的感兴趣流即可），其他的所有配置不变：
config vpn ipsec phase2-interface
edit "VPN-TO-Side1"
set phase1name "VPN-TO-Side1"
set proposal 3des-md5 aes128-sha1
set auto-negotiate enable
set src-subnet 192.168.111.0 255.255.255.0
set dst-subnet 192.168.112.0 255.255.255.0
next
end

Cisco_ASA配置：
hostname ASA-FW
!
interface GigabitEthernet0/0
nameif Outside
security-level 0
ip address 101.100.1.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif Inside
security-level 100
ip address 192.168.112.1 255.255.255.0
!
route Outside 0.0.0.0 0.0.0.0 101.100.1.254 1

object network Inside_Net_192.168.112.0
subnet 192.168.112.0 255.255.255.0

object network Inside_Net_192.168.112.0
nat (Inside,Outside) dynamic interface

object network Remote_VPN_Net_192.168.111.0
subnet 192.168.111.0 255.255.255.0

policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error

crypto ikev2 enable Outside

crypto ikev2 policy 10
encryption aes-256 aes-192 aes 3des
integrity sha256 sha md5
group 14 5
prf sha256 sha md5
lifetime seconds 86400

tunnel-group 202.106.1.1 type ipsec-l2l
tunnel-group 202.106.1.1 ipsec-attributes
ikev2 remote-authentication pre-shared-key Fortinet123#
ikev2 local-authentication pre-shared-key Fortinet123#

crypto ipsec ikev2 ipsec-proposal MY_IPsec_Proposal
protocol esp encryption aes-256 aes-192 aes 3des
protocol esp integrity sha-256 sha-1 md5

access-list VPN-Traffic extended permit ip object Inside_Net_192.168.112.0 object Remote_VPN_Net_192.168.111.0

crypto map MY_IPsec_MAP 10 match address VPN-Traffic
crypto map MY_IPsec_MAP 10 set pfs group5
crypto map MY_IPsec_MAP 10 set peer 202.106.1.1
crypto map MY_IPsec_MAP 10 set ikev2 ipsec-proposal MY_IPsec_Proposal
crypto map MY_IPsec_MAP interface Outside

nat (Inside,Outside) source static Inside_Net_192.168.112.0 Inside_Net_192.168.112.0 destination static Remote_VPN_Net_192.168.111.0 Remote_VPN_Net_192.168.111.0 //使用Twice NAT将VPN流量在NAT中Bypass掉