Cisco asa 5505 site to site vpn
Local interface will be in the ‘inside’ interface on the Fortigate > Enter the local subnet(s) > Enter the remote (behind the ASA) subnet(s) > Next. Give it the ‘public’ IP of the Cisco ASA > Set the port to the ‘outside’ port on the Fortigate > Enter a pre-shared key, (text string, you will need to enter this on the Cisco ASA as well, so paste it into Notepad or something for later) > Next. Create IKE/IPSec VPN Tunnel On Fortigateįrom the web management portal > VPN > IPSec Wizard > Give the tunnel a name > Change the remote device type to Cisco > Next. (They do on older versions of the OS, but not on the newer ones). And Fortinet enables PFS and Cisco don’t. Fortinet sets all the DH groups to 5, and Cisco sets them all to 2. Tech Note: If you just use both wizards it wont work, thankfully I could debug the tunnel on the Cisco ASA to work out why. This is an exercise in getting the tunnel up and making it work. I will post another article on the same subject, but then I’ll make the tunnel as secure as I can, (watch this space). Couple that with all the weak Crypto sets that get enabled, because someone might have a hardware firewall from 1981 or something! So in production I’d consider doing things a little more manually. Which means it enables IKEv1 NOT IKEv2 on the Fortigate, and BOTH IKEv1 and IKEv2 gets enabled on the Cisco ASA. This is designed for the ‘Let’s just make it work, who cares what’s going on under the hood‘ generation.
Well that’s the pretty picture, I’m building this EVE-NG so here’s what my workbench topology looks like ĭisclaimer (Read First! Especially before posting any comments!)įortinet prides itself on you not needing to use the CLI, (until you actually need to use the CLI of course!) But both ends are configured using the GUI and ASDM.
#Cisco asa 5505 site to site vpn how to#
As the bulk of my knowledge is Cisco ASA it seems sensible for me to work out how to VPN both those firewalls together, like so
One of the basic requirements of any edge firewall is site to site VPN. Continuing with my ‘ Learn some Fortigate‘ theme’.