FortiGate v7.6.6 リモートアクセス IPsec VPN 設定ガイド

config router static
    edit 1
        set gateway 100.110.120.2
        set device "wan1"
    next
    edit 2
        set dst 10.0.11.0 255.255.255.0
        set gateway 10.0.10.254
        set device "internal1"
    next
    edit 3
        set dst 10.0.21.0 255.255.255.0
        set gateway 10.0.20.254
        set device "internal2"
    next
end

config firewall address
    edit "10.0.11.0/24"
        set subnet 10.0.11.0 255.255.255.0
    next
    edit "10.0.21.0/24"
        set subnet 10.0.21.0 255.255.255.0
    next
end

config firewall address
    edit "VPN-Client_Range"
        set type iprange
        set start-ip 192.168.20.10
        set end-ip 192.168.20.200
    next
end

config firewall addrgrp
    edit "VPNSplit_AddrGrp"
        set member "10.0.11.0/24" "10.0.21.0/24"
    next
end

config user local
    edit "<ユーザ名>"
        set status enable
        set type password
        set passwd <ユーザのパスワードを入力>
    next
end

config user local
    edit "vpnuser01"
        set status enable
        set type password
        set passwd vpnuser01
    next
    edit "vpnuser02"
        set status enable
        set type password
        set passwd vpnuser02
    next
end

config user group
    edit "<グループ名>"
        set group-type firewall
        set member <ユーザ名を半角スペース区切りで入力>
    next
end

config user group
    edit "vpn-group"
        set group-type firewall
        set member "vpnuser01" "vpnuser02"
    next
end

des-md5
des-sha1
des-sha256
des-sha384
des-sha512
3des-md5
3des-sha1
3des-sha256
3des-sha384
3des-sha512
aes128-md5
aes128-sha1
aes128-sha256
aes128-sha384
aes128-sha512
aes128gcm-prfsha1
aes128gcm-prfsha256
aes128gcm-prfsha384
aes128gcm-prfsha512
aes192-md5
aes192-sha1
aes192-sha256
aes192-sha384
aes192-sha512
aes256-md5
aes256-sha1
aes256-sha256
aes256-sha384
aes256-sha512
aes256gcm-prfsha1
aes256gcm-prfsha256
aes256gcm-prfsha384
aes256gcm-prfsha512
chacha20poly1305-prfsha1
chacha20poly1305-prfsha256
chacha20poly1305-prfsha384
chacha20poly1305-prfsha512
aria128-md5
aria128-sha1
aria128-sha256
aria128-sha384
aria128-sha512
aria192-md5
aria192-sha1
aria192-sha256
aria192-sha384
aria192-sha512
aria256-md5
aria256-sha1
aria256-sha256
aria256-sha384
aria256-sha512
seed-md5
seed-sha1
seed-sha256
seed-sha384
seed-sha512

config vpn ipsec phase1-interface
    edit "RemoteVPN_01"
        set type dynamic
        set interface "wan1"
        set ike-version 2
        set peertype any
        set net-device disable
        set mode-cfg enable
        set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
        set dhgrp 20 21
        set eap enable
        set eap-identity send-request
        set wizard-type dialup-forticlient
        set authusrgrp "vpn-group"
        set transport udp
        set assign-ip-from name
        set ipv4-netmask 255.255.255.0
        set dns-mode auto
        set ipv4-split-include "VPNSplit_AddrGrp"
        set ipv4-name "VPN-Client_Range"
        set save-password enable
        set psksecret vpnpassword
    next
end

config system interface
    edit "RemoteVPN_01"
        set vdom "root"
        set type tunnel
        set snmp-index 16
        set interface "wan1"
    next
end

null-md5
null-sha1
null-sha256
null-sha384
null-sha512
des-null
des-md5
des-sha1
des-sha256
des-sha384
des-sha512
3des-null
3des-md5
3des-sha1
3des-sha256
3des-sha384
3des-sha512
aes128-null
aes128-md5
aes128-sha1
aes128-sha256
aes128-sha384
aes128-sha512
aes128gcm
aes192-null
aes192-md5
aes192-sha1
aes192-sha256
aes192-sha384
aes192-sha512
aes256-null
aes256-md5
aes256-sha1
aes256-sha256
aes256-sha384
aes256-sha512
aes256gcm
chacha20poly1305
aria128-null
aria128-md5
aria128-sha1
aria128-sha256
aria128-sha384
aria128-sha512
aria192-null
aria192-md5
aria192-sha1
aria192-sha256
aria192-sha384
aria192-sha512
aria256-null
aria256-md5
aria256-sha1
aria256-sha256
aria256-sha384
aria256-sha512
seed-null
seed-md5
seed-sha1
seed-sha256
seed-sha384
seed-sha512

config vpn ipsec phase2-interface
    edit "RemoteVPN_01"
        set phase1name "RemoteVPN_01"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set dhgrp 20 21
    next
end

config firewall policy
    edit 3
        set name "VPNClient_to_internal1"
        set srcintf "RemoteVPN_01"
        set dstintf "internal1"
        set action accept
        set srcaddr "VPN-Client_Range"
        set dstaddr "10.0.11.0/24"
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
    edit 4
        set name "VPNClient_to_internal2"
        set srcintf "RemoteVPN_01"
        set dstintf "internal2"
        set action accept
        set srcaddr "VPN-Client_Range"
        set dstaddr "10.0.21.0/24"
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end

FortiGate-60F # diagnose vpn ike gateway list

vd: root/0
name: RemoteVPN_01_0
version: 2
interface: wan1 5
addr: 100.110.120.1:500 -> 100.101.102.1:500
tun_id: 192.168.20.10/::10.0.0.4
remote_location: 0.0.0.0
network-id: 0
transport: UDP
created: 608s ago
eap-user: vpnuser01
2FA: no
peer-id: 10.1.10.33
peer-id-auth: no
FortiClient UID: FAB7675B582A4070876CA5EDC8BAD3D9
assigned IPv4 address: 192.168.20.10/255.255.255.0
pending-queue: 0
PPK: no
IKE SA: created 1/1  established 1/1  time 40/40/40 ms
IPsec SA: created 1/1  established 1/1  time 0/0/0 ms

  id/spi: 2 8fc13f98b8abc15b/0066ee058b31184e
  direction: responder
  status: established 608-608s ago = 40ms
  proposal: aes256-sha256
  child: no
  SK_ei: 492d50cf16fa91c9-01c50f6f27600db1-fd1dce97e6a4b29e-fc6961b69295d391
  SK_er: b35a143158fc4a35-aac8912e2475fbd1-01d35841c4e48a15-6825bf1a6b4ae709
  SK_ai: 29c5151134f6ada9-37e2e6b8ee9bb9ed-0bf596c8eeea74a8-378232fd631a2c97
  SK_ar: 1c9a335dd1b06ea6-c80a669b218981e6-c608b03222104ba2-429acae71f27a524
  PPK: no
  message-id sent/recv: 0/127
  QKD: no
  PQC-KEM (IKE): no
  PQC-KEM (all IPsec): no
  lifetime/rekey: 86400/85521
  DPD sent/recv: 00000000/00000000
  peer-id: 10.1.10.33

FortiGate-60F # diagnose vpn tunnel list
list all ipsec tunnel in vd 0
------------------------------------------------------
name=RemoteVPN_01 ver=2 serial=1 100.110.120.1:0->0.0.0.0:0 nexthop=0.0.0.0 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=0 weight=1
bound_if=5 real_if=0 lgwy=static/1 tun=intf mode=dialup/2 encap=none/552 options[0228]=npu frag-rfc  role=primary accept_traffic=1 overlay_id=0

proxyid_num=0 child_num=1 refcnt=3 ilast=42967607 olast=42967607 ad=/0
stat: rxp=625 txp=1292 rxb=99706 txb=19596
dpd: mode=on-demand on=-1 status=ok idle=20000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
fec: egress=0 ingress=0
------------------------------------------------------
name=RemoteVPN_01_0 ver=2 serial=4 100.110.120.1:0->100.101.102.1:0 nexthop=100.110.120.2 tun_id=192.168.20.10 tun_id6=::10.0.0.4 status=up dst_mtu=1500 weight=1
bound_if=5 real_if=5 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/8872 options[22a8]=npu rgwy-chg frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0

parent=RemoteVPN_01 index=0
proxyid_num=1 child_num=0 refcnt=5 ilast=51 olast=51 ad=/0
stat: rxp=395 txp=1292 rxb=57222 txb=19596
dpd: mode=on-demand on=1 status=ok idle=20000ms retry=3 count=0 seqno=2
natt: mode=none draft=0 interval=0 remote_port=0
fec: egress=0 ingress=0
proxyid=RemoteVPN_01 proto=0 sa=1 ref=2 serial=1 add-route
  src: 0:0.0.0.0-255.255.255.255:0
  dst: 0:192.168.20.10-192.168.20.10:0
  SA:  ref=6 options=6a6 type=00 soft=0 mtu=1438 expire=42535/0B replaywin=2048
       seqno=50b esn=0 replaywin_lastseq=00000107 qat=0 rekey=0 hash_search_len=1
  life: type=01 bytes=0/0 timeout=43187/43200
  dec: spi=c442fc81 esp=aes key=16 b6e9a3541660086df68076f5baeae9e4
       ah=sha1 key=20 65e4d36120cb354ababf945f8a43c9e957b7e17d
  enc: spi=9ba5b5a6 esp=aes key=16 dd8910cf1fde9a43db112848e77863ea
       ah=sha1 key=20 6b5c33969ba31ba80c2590296b4d376277826bd2
  dec:pkts/bytes=398/57612, enc:pkts/bytes=1298/20316
  npu_flag=03 npu_rgwy=100.101.102.1:0 npu_lgwy=100.110.120.1:0 npu_selid=2
  dec_npuid=1 enc_npuid=1 dec_engid=0 enc_engid=0 dec_saidx=7 enc_saidx=6

config vpn ipsec phase1-interface
    edit "トンネル名"
        set eap enable
        set eap-identity send-request
        unset authusrgrp
    next
end

config firewall policy
    edit 1
        set name "VPN-Group01"
        set srcintf "RemoteVPN_01"
        set dstintf "internal1"
        set action accept
        set srcaddr "all"
        set dstaddr "10.0.10.0/24"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set groups "vpn-group01"
    next
    edit 2
        set name "VPN-Group02"
        set srcintf "RemoteVPN_01"
        set dstintf "internal2"
        set action accept
        set srcaddr "VPN-Client_Range"
        set dstaddr "10.0.20.0/24"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set groups "vpn-group02"
    next
end

config vpn ipsec phase1-interface
    edit "トンネル名"
        set keylife 36000
        set reauth enable
    next
end