fortigate-ipsec-40-mr3

Protecting OSPF with IPsec OSPF over IPsec configuration
To configure Phase 2
1 Define the phase 2 parameters needed to create a VPN tunnel with the remote peer.
For more information, see “Phase 2 parameters” on page 57. Enter these settings in
particular:
Name
Phase 1
Configuring static routing
Configuring OSPF
Enter a name to identify this phase 2 configuration, twan1_p2, for
example.
Select the name of the phase 1 configuration that you defined in Step 1,
tunnel_wan1 for example.
You need to define the route for traffic leaving the external interface. Go to Router > Static
> Static Route, select Create New, and enter the following information.
Destination IP/Mask Leave as 0.0.0.0 0.0.0.0.
Device Select the external interface.
Gateway Enter the IP address of the next hop router.
Distance Leave setting at default value.
This section does not attempt to explain OSPF router configuration. It focusses on the
integration of the IPsec tunnel into the OSPF network. This is accomplished by assigning
the tunnel as an OSPF interface, creating an OSPF route to the other FortiGate unit.
This configuration uses loopback interfaces to ease OSPF troubleshooting. The OSPF
router ID is set to the loopback interface address.The loopback interface ensures the
router is always up. Even though technically the router ID doesn’t have to match a valid IP
address on the FortiGate unit, having an IP that matches the router ID makes
troubleshooting a lot easier.
The two FortiGate units have slightly different configurations. FortiGate_1 is an AS border
router that advertises its static default route. FortiGate_2 advertises its local LAN as an
OSPF internal route.
Setting the router ID for each FortiGate unit to the lowest possible value is useful if you
want the FortiGate units to be the designated router (DR) for their respective ASes. This is
the router that broadcasts the updates for the AS.
Leaving the IP address on the OSPF interface at 0.0.0.0 indicates that all potential routes
will be advertised, and it will not be limited to any specific subnet. For example if this IP
address was 10.1.0.0, then only routes that match that subnet will be advertised through
this interface in OSPF.
FortiGate_1 OSPF configuration
When configuring FortiGate_1 for OSPF, the loopback interface is created, and then you
configure OSPF area networks and interfaces.
With the exception of creating the loopback interface, OSPF for this example can all be
configured in either the web-based manager or CLI.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 223
http://docs.fortinet.com/