Multiple VXLANs over IPSec using virtual wire pair

[shivani_sharma]

Hello,

Has anyone been able to implement multiple VXLANs over virtual wire pair as described in the Fortigate link below? I have tried this in the lab and the IPSec tunnel does not come up and it does not work. Has anyone made this work?

https://kb.fortinet.com/kb/documentLink.do?externalID=FD47557

I setup this in the lab and when I debug ike I get below policy errors. But I am not sure what policy I should be adding, since it is not clear what should be interface other than ipsec in the policy. 

ike 0:ipsec: ignoring request to establish IPsec SA, no policy configured ike 0:ipsec:ipsec: IPsec SA connect 3 10.10.10.1->10.10.10.2:0 ike 0:ipsec: ignoring request to establish IPsec SA, no policy configured ike 0:ipsec:ipsec: IPsec SA connect 3 10.10.10.1->10.10.10.2:0

Following is my configuration

-------------------------------

FGT-1 --------

config system interface edit "port1" set vdom "root" set ip 10.10.10.1 255.255.255.0 set allowaccess ping https ssh http set type physical set snmp-index 1

config vpn ipsec phase1-interface edit "ipsec" set interface "port1" set peertype any set proposal des-sha1 set remote-gw 10.10.10.2 set psksecret Vxlantest next end

config vpn ipsec phase2-interface edit "ipsec" set phase1name "ipsec" set proposal des-sha1 set auto-negotiate enable next end

config system vxlan edit "vxlan" set interface "ipsec" set vni 100 set remote-ip "10.10.10.2" next end

config system virtual-wire-pair edit "vwp" set member "port3" "vxlan" set wildcard-vlan enable next end

config firewall policy edit 5 set name "vwp-pol" set srcintf "port3" "vxlan" set dstintf "port3" "vxlan" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" next end

FGT 2 ------

config system interface edit "port1" set vdom "root" set ip 10.10.10.2 255.255.255.0 set allowaccess ping https ssh http set type physical set snmp-index 1

config vpn ipsec phase1-interface edit "ipsec" set interface "port1" set peertype any set proposal des-sha1 set remote-gw 10.10.10.1 set psksecret Vxlantest next end

config vpn ipsec phase2-interface edit "ipsec" set phase1name "ipsec" set proposal des-sha1 set auto-negotiate enable next end

config system vxlan edit "vxlan" set interface "ipsec" set vni 100 set remote-ip "10.10.10.1" next end

config system virtual-wire-pair edit "vwp" set member "port2" "vxlan" set wildcard-vlan enable next end

config firewall policy edit 5 set name "vwp-pol" set srcintf "port2" "vxlan" set dstintf "port2" "vxlan" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" next end

[emnoc · Accepted solution]

1st off, the ipsec does not looking like vxlan-ipsec. It's missing at minimal "set encapsuationl vxlan "

The error in the debug is stating you have no policy defined for the define ipsec-interface. So ike and ipsec will never fully establish.

You need at least one policy for ipsec to work.

e.g

config firewall policy
edit 0
set name "ipsec-pol1"
set srcintf ipsec
set dstintf any
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
next
/* optional */

edit 0
set name "ipsec-pol2"
set srcintf any
set dstintf ipsec
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
next

end


I would do the above and then validate you have a ipsec phase1/phase2 b4 going any farther. As the virtual-wire-pair what  are you trying to accomplish?


Ken Felix

[shivani_sharma]

emnoc wrote:

1st off, the ipsec does not looking like vxlan-ipsec. It's missing at minimal "set encapsuationl vxlan "

The error in the debug is stating you have no policy defined for the define ipsec-interface. So ike and ipsec will never fully establish.

You need at least one policy for ipsec to work.

e.g

config firewall policy
edit 0
set name "ipsec-pol1"
set srcintf ipsec
set dstintf any
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
next
/* optional */

edit 0
set name "ipsec-pol2"
set srcintf any
set dstintf ipsec
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
next

end


I would do the above and then validate you have a ipsec phase1/phase2 b4 going any farther. As the virtual-wire-pair what are you trying to accomplish?


Ken Felix

Hello Ken,

Thank you. After adding the policy you suggested the ipsec came up. However, I cannot ping from end to end on VXLAN. According to the Fortinet KB link I shared in my original post, this configuration should create a virtual wire pair over the IPSec tunnel and we should be able to extend VLANS over IPSec. But it does not seem to work. Do you know what I am missing? Is there another way to extend multiple VLANS between two sites over IPSec? I know we can do a single vlan using the VXLAN over IPSec, but if I would like to extend multiple VLANS then how do I do it? 

[boneyard]

im sure the set encapsulation VXLAN is not needed, that is one way of doing VXLAN over IPsec, but you can do it without it also.

the scenario from the KB shivani shares, look very much what we have running. but instead of the virtual wire pair we use the virtual switch for this.

this still shows some info on this

https://forum.fortinet.com/tm.aspx?m=168761

it does support multiple VLANs over VXLAN.

but when i search for it now i believe Fortinet is removing older information on this, so the virtual wire pair path might be the best way forward. if you have a support contract you can open a ticket for this. you are just building something from the cookbook and it doesn't work. to me that feels within their scope.

if you don't, you say you can't ping across, what are you trying to ping from where?

when you snif the VPN interface, do you see VXLAN traffic?