Security Fabric over IPsec VPN

1. Configuring the tunnel interfaces

In order for FortiTelemetry traffic to flow securely through the IPsec VPN, FortiTelemetry traffic must travel between the tunnel interfaces, with the interface on External listening for this traffic.

The tunnel interfaces require IP addresses. In this example, the External tunnel interface is assigned the IP address 1.1.1.1 and the Branch tunnel interface is assigned the IP address 1.1.1.2.

On External, go to Network > Interfaces and edit the tunnel interface.

Set IP to the local IP address for this interface (1.1.1.1) and Remote IP to the local IP address for the Branch tunnel interface (1.1.1.2).

Under Administrative Access, enable FortiTelemetry.

On Branch, go to Network > Interfaces and edit the tunnel interface.

Set IP to the local IP address for this interface (1.1.1.2) and Remote IP to the local IP address for the External tunnel interface (1.1.1.1). 

2. Adding the tunnel interfaces to the VPN

Create a second address for the Branch tunnel interface.

For this address, enable Static Route Configuration.

Go to VPN > IPsec Tunnels and edit the VPN tunnel. Select Convert To Custom Tunnel.

Under Phase 2 Selectors, create a second Phase 2 allowing traffic between the External tunnel interface to the Branch tunnel interface.

Go to Network > Static Routes and create a route to the Branch tunnel interface.

Set Destination to Named Address and select the firewall address. Set Device to the tunnel interface.

Go to Policy & Objects > IPv4 Policy and edit the policy allowing local VPN traffic.

Set Source to include the External tunnel interface and Destination to include the Branch tunnel interface.

On Branch, repeat this step to include the following:

• Addresses for both tunnel interfaces (the address for the Branch tunnel interface must have Static Route Configuration enabled)
• A Phase 2 allowing traffic between the Branch tunnel interface and the External tunnel interface
• A static route to the External tunnel interface
• Edited policies that allow traffic to flow between the tunnel interfaces

Go to Monitor > IPsec Monitor and restart the VPN tunnel, allowing the new phase 2 to take effect.

3. Adding Branch to the Security Fabric

On Branch, go to Security Fabric > Settings and enable FortiGate Telemetry. Set the Group name and Group password of the Security Fabric.

Enable Connect to upstream FortiGate and set FortiGate IP to the IP address of the External tunnel interface.

Add lan to the list of FortiTelemetry enabled interfaces.

4. Allowing Branch to access the FortiAnalyzer

On Branch, go to Policy & Objects > Addresses and create an address for the FortiAnalyzer.

Enable Static Route Configuration.

Go to VPN > IPsec Tunnels and create a Phase 2 allowing traffic between the Branch tunnel interface and the FortiAnalyzer.

Go to Network > Static Routes and create a route to the FortiAnalyzer.

Go to Policy & Objects > IPv4 Policy and create a policy allowing traffic from the VPN tunnel to the FortiAnalyzer.

Enable NAT for this policy.

5. Results

6. (Optional) Using local logging for Branch

If you would prefer to use local logging for Branch, rather than sending logs to a remote FortiAnalyzer, you can do so using the following CLI command:

config system csf
  set logging-mode local
end

You can then go to Log & Report > Log Settings and configure local logging as required.

This option is available for all FortiGates in the Security Fabric, except for the root FortiGate.