Basic Site-to-Site VPN Between Two FortiGates

Sample content — demonstrates the Lab template.

Objective

Configure a route-based IPsec site-to-site VPN between two FortiGate firewalls and verify traffic passes correctly between both LANs.

Topology

[LAN-A: 192.168.10.0/24] -- FGT-A (WAN: 203.0.113.1) === Internet === FGT-B (WAN: 203.0.113.2) -- [LAN-B: 192.168.20.0/24]

Requirements

• 2x FortiGate (VM or physical), FortiOS 7.x
• Reachability between both WAN interfaces
• A host on each internal LAN for verification

Steps

1. On FGT-A, create a Phase 1 IPsec tunnel pointing to FGT-B’s WAN IP, with a pre-shared key.
2. Create a Phase 2 selector matching 192.168.10.0/24 ⟷ 192.168.20.0/24.
3. Repeat the mirrored configuration on FGT-B.
4. Add static routes on both firewalls pointing the remote subnet through the new VPN interface.
5. Create firewall policies permitting traffic in both directions across the tunnel.

Verification

• Bring the tunnel up and confirm Phase 1/Phase 2 status is “Up” on both sides.
• From a host on LAN-A, ping a host on LAN-B.
• Check the FortiGate VPN monitor for active tunnel traffic counters increasing.

Troubleshooting

• Tunnel won’t come up — check that the pre-shared key matches exactly and Phase 1 proposals (encryption/DH group) match on both sides.
• Tunnel up, but no traffic passes — check firewall policies and static routes; the tunnel being “up” only confirms Phase 1/2 negotiation, not that policy allows traffic.

Key takeaways

• Route-based VPNs use a virtual interface — treat it like any other interface in routing and policy.
• A tunnel showing “Up” does not mean traffic is actually allowed through — policy and routing are separate checks.