{"id":1130,"date":"2022-01-15T22:02:00","date_gmt":"2022-01-16T06:02:00","guid":{"rendered":"https:\/\/tungle.ca\/?p=1130"},"modified":"2022-04-16T16:53:54","modified_gmt":"2022-04-17T00:53:54","slug":"create-an-ipsec-site-to-site-tunnel-between-palo-alto-and-fortigate","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=1130","title":{"rendered":"Create an IPSEC site-to-site tunnel between Palo Alto And FortiGate."},"content":{"rendered":"\n<p>This is the lab to use to set up the IPSEC site-to-site tunnel between both devices.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"776\" height=\"455\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-504.png\" alt=\"\" class=\"wp-image-1154\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-504.png 776w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-504-300x176.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-504-768x450.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-504-200x117.png 200w\" sizes=\"auto, (max-width: 776px) 100vw, 776px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-482.png\" alt=\"\" class=\"wp-image-1131\" width=\"618\" height=\"374\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-482.png 926w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-482-300x182.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-482-768x466.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-482-200x121.png 200w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/><\/figure>\n\n\n\n<p>On Palo Alto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1023\" height=\"733\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-483.png\" alt=\"\" class=\"wp-image-1132\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-483.png 1023w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-483-300x215.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-483-768x550.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-483-200x143.png 200w\" sizes=\"auto, (max-width: 1023px) 100vw, 1023px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"767\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-484-1024x767.png\" alt=\"\" class=\"wp-image-1133\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-484-1024x767.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-484-300x225.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-484-768x575.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-484-200x150.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-484.png 1026w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"871\" height=\"574\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-485.png\" alt=\"\" class=\"wp-image-1134\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-485.png 871w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-485-300x198.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-485-768x506.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-485-200x132.png 200w\" sizes=\"auto, (max-width: 871px) 100vw, 871px\" \/><\/figure>\n\n\n\n<p>IKE Crypto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1018\" height=\"734\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-486.png\" alt=\"\" class=\"wp-image-1135\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-486.png 1018w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-486-300x216.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-486-768x554.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-486-200x144.png 200w\" sizes=\"auto, (max-width: 1018px) 100vw, 1018px\" \/><\/figure>\n\n\n\n<p>IPSEC Crypto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1011\" height=\"740\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-487.png\" alt=\"\" class=\"wp-image-1136\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-487.png 1011w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-487-300x220.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-487-768x562.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-487-200x146.png 200w\" sizes=\"auto, (max-width: 1011px) 100vw, 1011px\" \/><\/figure>\n\n\n\n<p>IKE Gateway.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"733\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-488.png\" alt=\"\" class=\"wp-image-1137\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-488.png 1013w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-488-300x217.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-488-768x556.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-488-200x145.png 200w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"816\" height=\"579\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-489.png\" alt=\"\" class=\"wp-image-1138\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-489.png 816w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-489-300x213.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-489-768x545.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-489-200x142.png 200w\" sizes=\"auto, (max-width: 816px) 100vw, 816px\" \/><\/figure>\n\n\n\n<p>IPSec tunnel.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1010\" height=\"680\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-490.png\" alt=\"\" class=\"wp-image-1139\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-490.png 1010w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-490-300x202.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-490-768x517.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-490-200x135.png 200w\" sizes=\"auto, (max-width: 1010px) 100vw, 1010px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1017\" height=\"733\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-491.png\" alt=\"\" class=\"wp-image-1140\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-491.png 1017w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-491-300x216.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-491-768x554.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-491-200x144.png 200w\" sizes=\"auto, (max-width: 1017px) 100vw, 1017px\" \/><\/figure>\n\n\n\n<p>Create a virtual route from PA to Fortinet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"872\" height=\"687\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-492.png\" alt=\"\" class=\"wp-image-1141\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-492.png 872w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-492-300x236.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-492-768x605.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-492-200x158.png 200w\" sizes=\"auto, (max-width: 872px) 100vw, 872px\" \/><\/figure>\n\n\n\n<p>Create two Security Policies to allow traffic from the &#8220;Trusted Zone&#8221; of PA to the &#8220;Trusted Zone&#8221; of Fortinet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1023\" height=\"580\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-496.png\" alt=\"\" class=\"wp-image-1145\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-496.png 1023w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-496-300x170.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-496-768x435.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-496-200x113.png 200w\" sizes=\"auto, (max-width: 1023px) 100vw, 1023px\" \/><\/figure>\n\n\n\n<p>Configure Fortinet.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>config system interface\nedit port1\nset mode dhcp\nset allowaccess ping httpd http fgfm\nnext\nend\nshow system interface \n# show system interface to get IP Address from DHCP<\/code><\/pre>\n\n\n\n<p>Go to Webterm to configure Fortinet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1005\" height=\"664\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-493.png\" alt=\"\" class=\"wp-image-1142\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-493.png 1005w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-493-300x198.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-493-768x507.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-493-200x132.png 200w\" sizes=\"auto, (max-width: 1005px) 100vw, 1005px\" \/><\/figure>\n\n\n\n<p>Configure a custom VPN Tunnel with the following information.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"713\" height=\"598\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-494.png\" alt=\"\" class=\"wp-image-1143\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-494.png 713w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-494-300x252.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-494-200x168.png 200w\" sizes=\"auto, (max-width: 713px) 100vw, 713px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1010\" height=\"745\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-495.png\" alt=\"\" class=\"wp-image-1144\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-495.png 1010w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-495-300x221.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-495-768x566.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-495-200x148.png 200w\" sizes=\"auto, (max-width: 1010px) 100vw, 1010px\" \/><\/figure>\n\n\n\n<p>Configure a static route to allow traffic from Trusted Zone (192.168.20.0\/24) on Fortinet to the Trusted Zone (192.168.10.0\/24) on PA.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"668\" height=\"570\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-497.png\" alt=\"\" class=\"wp-image-1146\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-497.png 668w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-497-300x256.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-497-200x171.png 200w\" sizes=\"auto, (max-width: 668px) 100vw, 668px\" \/><\/figure>\n\n\n\n<p>Create two Security policies to allow traffic from VPN to Trusted Zone and vice versa.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"999\" height=\"507\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-498.png\" alt=\"\" class=\"wp-image-1147\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-498.png 999w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-498-300x152.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-498-768x390.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-498-200x102.png 200w\" sizes=\"auto, (max-width: 999px) 100vw, 999px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"657\" height=\"733\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-499.png\" alt=\"\" class=\"wp-image-1148\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-499.png 657w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-499-269x300.png 269w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-499-179x200.png 179w\" sizes=\"auto, (max-width: 657px) 100vw, 657px\" \/><\/figure>\n\n\n\n<p>Ping and traceroute from a VM on Fortinet to another VM on Palo Alto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"712\" height=\"686\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-500.png\" alt=\"\" class=\"wp-image-1149\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-500.png 712w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-500-300x289.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-500-200x193.png 200w\" sizes=\"auto, (max-width: 712px) 100vw, 712px\" \/><\/figure>\n\n\n\n<p>Monitor IPSEC tunnel on Fortinet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"468\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-501.png\" alt=\"\" class=\"wp-image-1150\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-501.png 996w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-501-300x141.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-501-768x361.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-501-200x94.png 200w\" sizes=\"auto, (max-width: 996px) 100vw, 996px\" \/><\/figure>\n\n\n\n<p>Monitor IPSEC tunnel on PA.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1016\" height=\"478\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-502.png\" alt=\"\" class=\"wp-image-1151\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-502.png 1016w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-502-300x141.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-502-768x361.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-502-200x94.png 200w\" sizes=\"auto, (max-width: 1016px) 100vw, 1016px\" \/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is the lab to use to set up the IPSEC site-to-site tunnel between both devices. On Palo Alto. IKE Crypto. IPSEC Crypto. IKE Gateway. IPSec tunnel. Create a virtual route from PA to Fortinet. Create two Security Policies to allow traffic from the &#8220;Trusted Zone&#8221; of PA to the &#8220;Trusted Zone&#8221; of Fortinet. Configure [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,21,11],"tags":[14,18,13],"class_list":["post-1130","post","type-post","status-publish","format-standard","hentry","category-fortigate","category-palo-alto","category-security","tag-fortinet","tag-palo-alto","tag-security"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1130"}],"version-history":[{"count":4,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1130\/revisions"}],"predecessor-version":[{"id":2882,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1130\/revisions\/2882"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}