{"id":3395,"date":"2022-04-27T08:46:03","date_gmt":"2022-04-27T16:46:03","guid":{"rendered":"https:\/\/tungle.ca\/?p=3395"},"modified":"2022-05-06T06:33:16","modified_gmt":"2022-05-06T14:33:16","slug":"set-up-an-ipsec-vpn-site-to-site-between-fortigate-on-prem-and-microsoft-azure-2","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=3395","title":{"rendered":"Set up an IPSEC VPN site-to-site between FortiGate on-prem and Microsoft Azure"},"content":{"rendered":"\n<p>This is a diagram that I have used for the lab. I have used the same topology to deploy VPN site to site between Azure and Palo Alto firewall on-prem (https:\/\/tungle.ca\/?p=3338). Basically I removed the Palo Alto firewall and put FortiGate in the diagram.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"808\" height=\"444\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-791.png\" alt=\"\" class=\"wp-image-3399\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-791.png 808w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-791-300x165.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-791-768x422.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-791-200x110.png 200w\" sizes=\"auto, (max-width: 808px) 100vw, 808px\" \/><\/figure>\n\n\n\n<p>Create a new virtual network is Azure-PA.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"673\" height=\"536\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-736.png\" alt=\"\" class=\"wp-image-3339\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-736.png 673w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-736-300x239.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-736-200x159.png 200w\" sizes=\"auto, (max-width: 673px) 100vw, 673px\" \/><\/figure>\n\n\n\n<p>Change default network to PrivateSubnet is 10.0.1.0.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"669\" height=\"496\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-737.png\" alt=\"\" class=\"wp-image-3340\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-737.png 669w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-737-300x222.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-737-200x148.png 200w\" sizes=\"auto, (max-width: 669px) 100vw, 669px\" \/><\/figure>\n\n\n\n<p>A subnet address range is 10.0.1.0\/24<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"250\" height=\"544\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-739.png\" alt=\"\" class=\"wp-image-3342\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-739.png 250w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-739-138x300.png 138w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-739-92x200.png 92w\" sizes=\"auto, (max-width: 250px) 100vw, 250px\" \/><\/figure>\n\n\n\n<p>Click Create.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"553\" height=\"771\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-741.png\" alt=\"\" class=\"wp-image-3344\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-741.png 553w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-741-215x300.png 215w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-741-143x200.png 143w\" sizes=\"auto, (max-width: 553px) 100vw, 553px\" \/><\/figure>\n\n\n\n<p>Create a new subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"881\" height=\"423\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-742.png\" alt=\"\" class=\"wp-image-3345\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-742.png 881w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-742-300x144.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-742-768x369.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-742-200x96.png 200w\" sizes=\"auto, (max-width: 881px) 100vw, 881px\" \/><\/figure>\n\n\n\n<p>A subnetwork address range is 10.0.0.0\/24<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"482\" height=\"619\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-743.png\" alt=\"\" class=\"wp-image-3346\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-743.png 482w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-743-234x300.png 234w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-743-156x200.png 156w\" sizes=\"auto, (max-width: 482px) 100vw, 482px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"403\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-744-1024x403.png\" alt=\"\" class=\"wp-image-3347\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-744-1024x403.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-744-300x118.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-744-768x303.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-744-200x79.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-744.png 1028w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Go to &#8220;Virtual network gateway&#8221; to create a new virtual network gateway.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"714\" height=\"573\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-745.png\" alt=\"\" class=\"wp-image-3348\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-745.png 714w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-745-300x241.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-745-200x161.png 200w\" sizes=\"auto, (max-width: 714px) 100vw, 714px\" \/><\/figure>\n\n\n\n<p>Virtual network: Azure-PA.<\/p>\n\n\n\n<p>Subnet: Gatewaysubnet 10.0.0.0\/24<\/p>\n\n\n\n<p>Public IP address name: VPNIP<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"704\" height=\"874\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-746.png\" alt=\"\" class=\"wp-image-3349\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-746.png 704w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-746-242x300.png 242w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-746-161x200.png 161w\" sizes=\"auto, (max-width: 704px) 100vw, 704px\" \/><\/figure>\n\n\n\n<p>Click Create.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"556\" height=\"841\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-747.png\" alt=\"\" class=\"wp-image-3350\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-747.png 556w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-747-198x300.png 198w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-747-132x200.png 132w\" sizes=\"auto, (max-width: 556px) 100vw, 556px\" \/><\/figure>\n\n\n\n<p>Wait around from 20 to 30 minutes to see if the Deployment will be done.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"412\" height=\"252\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-749.png\" alt=\"\" class=\"wp-image-3352\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-749.png 412w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-749-300x183.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-749-200x122.png 200w\" sizes=\"auto, (max-width: 412px) 100vw, 412px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"970\" height=\"349\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-750.png\" alt=\"\" class=\"wp-image-3353\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-750.png 970w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-750-300x108.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-750-768x276.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-750-200x72.png 200w\" sizes=\"auto, (max-width: 970px) 100vw, 970px\" \/><\/figure>\n\n\n\n<p>Go to &#8220;Local network gateway&#8221; and create a new local network gateway.<\/p>\n\n\n\n<p>An IP address is a public IP address of the Palo Alto firewall.<\/p>\n\n\n\n<p>Address space is Palo Alto&#8217;s LAN subnets.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"673\" height=\"673\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-751.png\" alt=\"\" class=\"wp-image-3354\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-751.png 673w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-751-300x300.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-751-150x150.png 150w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-751-200x200.png 200w\" sizes=\"auto, (max-width: 673px) 100vw, 673px\" \/><\/figure>\n\n\n\n<p>Clock create.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"637\" height=\"414\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-752.png\" alt=\"\" class=\"wp-image-3355\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-752.png 637w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-752-300x195.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-752-200x130.png 200w\" sizes=\"auto, (max-width: 637px) 100vw, 637px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"947\" height=\"321\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-753.png\" alt=\"\" class=\"wp-image-3356\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-753.png 947w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-753-300x102.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-753-768x260.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-753-200x68.png 200w\" sizes=\"auto, (max-width: 947px) 100vw, 947px\" \/><\/figure>\n\n\n\n<p>Go to &#8220;Virtual network gateways&#8221;, and select the virtual network gateways that we have created in the previous step.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"256\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-754-1024x256.png\" alt=\"\" class=\"wp-image-3357\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-754-1024x256.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-754-300x75.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-754-768x192.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-754-200x50.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-754.png 1043w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Go to &#8220;Connections&#8221; &#8211; Add.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"844\" height=\"339\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-755.png\" alt=\"\" class=\"wp-image-3358\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-755.png 844w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-755-300x120.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-755-768x308.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-755-200x80.png 200w\" sizes=\"auto, (max-width: 844px) 100vw, 844px\" \/><\/figure>\n\n\n\n<p>Enter a shared key (PSK) for VPN site-to-site.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"345\" height=\"897\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-756.png\" alt=\"\" class=\"wp-image-3359\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-756.png 345w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-756-115x300.png 115w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-756-77x200.png 77w\" sizes=\"auto, (max-width: 345px) 100vw, 345px\" \/><\/figure>\n\n\n\n<p>Take note of the IP address of Azure VPN.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"461\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-766-1024x461.png\" alt=\"\" class=\"wp-image-3369\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-766-1024x461.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-766-300x135.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-766-768x346.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-766-200x90.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-766.png 1322w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"328\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-757-1024x328.png\" alt=\"\" class=\"wp-image-3360\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-757-1024x328.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-757-300x96.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-757-768x246.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-757-200x64.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-757.png 1049w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"396\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-759-1024x396.png\" alt=\"\" class=\"wp-image-3362\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-759-1024x396.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-759-300x116.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-759-768x297.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-759-200x77.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-759.png 1159w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>On FortiGate on-prem.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"681\" height=\"524\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-801.png\" alt=\"\" class=\"wp-image-3409\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-801.png 681w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-801-300x231.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-801-200x154.png 200w\" sizes=\"auto, (max-width: 681px) 100vw, 681px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"851\" height=\"659\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-802.png\" alt=\"\" class=\"wp-image-3410\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-802.png 851w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-802-300x232.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-802-768x595.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-802-200x155.png 200w\" sizes=\"auto, (max-width: 851px) 100vw, 851px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"510\" height=\"357\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-803.png\" alt=\"\" class=\"wp-image-3411\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-803.png 510w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-803-300x210.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-803-200x140.png 200w\" sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><\/figure>\n\n\n\n<p>Create a static default route.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"637\" height=\"409\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-804.png\" alt=\"\" class=\"wp-image-3412\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-804.png 637w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-804-300x193.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-804-200x128.png 200w\" sizes=\"auto, (max-width: 637px) 100vw, 637px\" \/><\/figure>\n\n\n\n<p>Configure an IPSEC Tunnel.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"735\" height=\"381\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-799.png\" alt=\"\" class=\"wp-image-3407\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-799.png 735w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-799-300x156.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-799-200x104.png 200w\" sizes=\"auto, (max-width: 735px) 100vw, 735px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"584\" height=\"407\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-805.png\" alt=\"\" class=\"wp-image-3413\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-805.png 584w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-805-300x209.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-805-200x139.png 200w\" sizes=\"auto, (max-width: 584px) 100vw, 584px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"546\" height=\"361\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-822.png\" alt=\"\" class=\"wp-image-3432\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-822.png 546w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-822-300x198.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-822-200x132.png 200w\" sizes=\"auto, (max-width: 546px) 100vw, 546px\" \/><\/figure>\n\n\n\n<p>Phase 1.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"545\" height=\"605\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-810.png\" alt=\"\" class=\"wp-image-3418\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-810.png 545w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-810-270x300.png 270w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-810-180x200.png 180w\" sizes=\"auto, (max-width: 545px) 100vw, 545px\" \/><\/figure>\n\n\n\n<p>Phase 2.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"791\" height=\"657\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-811.png\" alt=\"\" class=\"wp-image-3419\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-811.png 791w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-811-300x249.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-811-768x638.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-811-200x166.png 200w\" sizes=\"auto, (max-width: 791px) 100vw, 791px\" \/><\/figure>\n\n\n\n<p>Create a new network object for FortiGate.<\/p>\n\n\n\n<p>FG-LAN: 172.16.0.0\/16<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"389\" height=\"365\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-812.png\" alt=\"\" class=\"wp-image-3420\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-812.png 389w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-812-300x281.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-812-200x188.png 200w\" sizes=\"auto, (max-width: 389px) 100vw, 389px\" \/><\/figure>\n\n\n\n<p>Azure-LAN: 10.0.0.0\/16.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"387\" height=\"364\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-815.png\" alt=\"\" class=\"wp-image-3423\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-815.png 387w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-815-300x282.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-815-200x188.png 200w\" sizes=\"auto, (max-width: 387px) 100vw, 387px\" \/><\/figure>\n\n\n\n<p>Create both access rules to allow traffic from FortiGate LAN subnets to your Azure VPN private subnets. Remember &#8220;Disable NAT&#8221; on these rules.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"603\" height=\"657\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-816.png\" alt=\"\" class=\"wp-image-3424\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-816.png 603w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-816-275x300.png 275w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-816-184x200.png 184w\" sizes=\"auto, (max-width: 603px) 100vw, 603px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"610\" height=\"656\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-813.png\" alt=\"\" class=\"wp-image-3421\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-813.png 610w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-813-279x300.png 279w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-813-186x200.png 186w\" sizes=\"auto, (max-width: 610px) 100vw, 610px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"779\" height=\"437\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-814.png\" alt=\"\" class=\"wp-image-3422\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-814.png 779w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-814-300x168.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-814-768x431.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-814-200x112.png 200w\" sizes=\"auto, (max-width: 779px) 100vw, 779px\" \/><\/figure>\n\n\n\n<p>Create a static route to allow traffic from FortiGate LAN subnets to your Azure private subnets via the IPSEC VPN site-to-site IKEv2 tunnel.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"657\" height=\"405\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-817.png\" alt=\"\" class=\"wp-image-3425\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-817.png 657w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-817-300x185.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-817-200x123.png 200w\" sizes=\"auto, (max-width: 657px) 100vw, 657px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"845\" height=\"386\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-818.png\" alt=\"\" class=\"wp-image-3426\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-818.png 845w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-818-300x137.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-818-768x351.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-818-200x91.png 200w\" sizes=\"auto, (max-width: 845px) 100vw, 845px\" \/><\/figure>\n\n\n\n<p>Ping from Kali machine to Windows 2016 on Azure.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"797\" height=\"569\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-821.png\" alt=\"\" class=\"wp-image-3429\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-821.png 797w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-821-300x214.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-821-768x548.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-821-200x143.png 200w\" sizes=\"auto, (max-width: 797px) 100vw, 797px\" \/><\/figure>\n\n\n\n<p>The tunnel is up on FortiGate.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"844\" height=\"654\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-819.png\" alt=\"\" class=\"wp-image-3427\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-819.png 844w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-819-300x232.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-819-768x595.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-819-200x155.png 200w\" sizes=\"auto, (max-width: 844px) 100vw, 844px\" \/><\/figure>\n\n\n\n<p>Ping a Kali machine on FortiGate LAN subnet from Azure.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"521\" height=\"431\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-820.png\" alt=\"\" class=\"wp-image-3428\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-820.png 521w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-820-300x248.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-820-200x165.png 200w\" sizes=\"auto, (max-width: 521px) 100vw, 521px\" \/><\/figure>\n\n\n\n<p>Back to VPN2S, we can see the VPN status connection is \u201cConnected\u201d.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-784-1024x371.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is a diagram that I have used for the lab. I have used the same topology to deploy VPN site to site between Azure and Palo Alto firewall on-prem (https:\/\/tungle.ca\/?p=3338). Basically I removed the Palo Alto firewall and put FortiGate in the diagram. Create a new virtual network is Azure-PA. Change default network to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,3],"tags":[20,27],"class_list":["post-3395","post","type-post","status-publish","format-standard","hentry","category-cloud","category-fortigate","tag-cloud","tag-fortigate"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3395"}],"version-history":[{"count":7,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3395\/revisions"}],"predecessor-version":[{"id":3751,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3395\/revisions\/3751"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}