配置FortiGate与Cisco IPSec VPN互联
2012-12-24 15:05:32   来源：   评论：0 点击：

说明：
本文档针对所有FortiGate 与Cisco 设备VPN互联进行说明，本例中使用点对点的IPSec使用预共享密钥的配置方式。
环境介绍：
本文使用FortiGate82C 及Cisco2621做演示。本文支持的Fortigate系统版本为FortiOS v4.0。Cisco的版本为12.3(14)T7

 

1.配置FortiGate端IPsec VPN
步骤一：配置IKE
首先在虚拟专网----IPSEC中建立一个VPN通道，本地接口分别是500A的两个外网接口。在阶段一高级中启动IPSEC接口模式并勾选对等体状态探测。继续创建阶段二，输入快速模式选择器


步骤二：设置路由
在路由----静态中新建去往对端私网并走VPN的路由。


步骤三:设置策略
添加Cisco Vpn 和port1 接口的策略

 

2.配置Cisco端IPsec VPN
详细配置见如下:
hostname Rack2-2621-4
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key 123456 address 10.0.0.136
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map togate 10 ipsec-isakmp
set peer 10.0.0.136
set transform-set myset
match address 101
!
interface FastEthernet0/0
description out
ip address 10.0.0.214 255.255.255.0
ip nat outside
duplex auto
speed auto
crypto map togate
!
interface FastEthernet0/1
description in
ip address 10.10.164.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.1
!
ip http server
no ip http secure-server
ip nat inside source list 102 interface FastEthernet0/0 overload
!
access-list 101 permit ip 10.10.164.0 0.0.0.255 10.10.61.0 0.0.0.255
access-list 102 deny ip 10.10.164.0 0.0.0.255 any
access-list 102 permit ip any any
!
End

3.验证联通性
Cisco 端去往FortiGate内网，使用源地址ping：
Rack2-2621-4#ping
Protocol [ip]:
Target IP address: 10.10.61.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 10.10.164.1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.61.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.164.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
从FortiGate端 ping Cisco内网
FGT82C-1 # exe ping-o so 10.10.61.1
FGT82C-1 # exe ping 10.10.164.1
PING 10.10.164.1 (10.10.164.1): 56 data bytes
64 bytes from 10.10.164.1: icmp_seq=0 ttl=255 time=7.0 ms
64 bytes from 10.10.164.1: icmp_seq=1 ttl=255 time=6.8 ms
64 bytes from 10.10.164.1: icmp_seq=2 ttl=255 time=7.1 ms
64 bytes from 10.10.164.1: icmp_seq=3 ttl=255 time=7.5 ms
64 bytes from 10.10.164.1: icmp_seq=4 ttl=255 time=6.9 ms
--- 10.10.164.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 6.8/7.0/7.5 ms
FGT82C-1 #