Fortigate as dialup VPN Server и Сisco IOS как dialup VPN Client (IPSec)

Ситуация:
Fortigate развернут как Dialup VPN сервер в следующем варианте:

IKE (Phase I):

FGT61E (phase1-interface) # show
config vpn ipsec phase1-interface
    edit "FGT-Cisco"
        set type dynamic
        set interface "wan1"
        set local-gw <wan1 IP>
        set mode aggressive
        set peertype one
        set proposal 3des-sha1
        set dhgrp 5
        set peerid "c1841"
        set psksecret ENC <key> 
   next
end

IPSec (Phase II):

FGT61E (phase2-interface) # show

config vpn ipsec phase2-interface

    edit "FGT-Cisco-IPSEC"

        set phase1name "FGT-Cisco"

        set proposal 3des-sha1

        set pfs disable

        set replay disable

        set keylifeseconds 3600

    next

end

FGT61 # get system interface

== [ FGT-Cisco ]

name: FGT-Cisco   ip: 10.254.254.1 255.255.255.255   status: up    netbios-forward: disable    type: tunnel   netflow-sampler: disable    sflow-sampler: disable    scan-botnet-connections: disable    src-check: enable    explicit-web-proxy: disable    explicit-ftp-proxy: disable    proxy-captive-portal: disable    wccp: disable

Нужно чтобы Fortigate обеспечивал прием входящих VPN-подключений от маршрутизатора Cisco, который находится на удаленной площадке за NAT, причем имеет на внешнем интерфейсе динамический IP-адрес (DHCP).

Особенностью данного решения является, то что Fortigate настроен как Dial-up VPN сервер, т.е он не знает об IP удаленной стороны изначально как в обычном Site-2-Site развертывании.

При этом Fortigate в таком режиме для VPN-интерфейса назначает маску /32, а мы еще хотим чтобы по данному туннелю Routed Based VPN бегал дополнительно еще и OSPFv2, чтобы нам нам не прописывать дополнительно статические маршруты с обоих стороны в сторону удаленной площадки.

Cisco же не позволяет напрямую прописать на туннельном интерфейсе маску /32, но это поведение можно обойти с помощью loopback интерфейсов и IP unnumbered на туннеле, привязанном к данном Loopback-интерфейсу.

Решение:

Настройки со стороны Cisco в данном случае выглядит следующим образом:

crypto isakmp policy 1

 encr 3des

 authentication pre-share

 group 5

!

crypto isakmp peer address <Fortigate WAN1 IP>

 set aggressive-mode password <ключ>

 set aggressive-mode client-endpoint fqdn c1841

!

crypto ipsec security-association replay disable

!

crypto ipsec transform-set ESP_3DES esp-3des esp-sha-hmac

!

crypto ipsec profile test

 set transform-set ESP_3DES

interface Loopback1

 ip address 10.254.254.2 255.255.255.255

!

interface Tunnel0

 ip unnumbered Loopback1

 ip mtu 1400

 ip ospf network point-to-point

 ip ospf mtu-ignore

 tunnel source FastEthernet0/0

 tunnel mode ipsec ipv4

 tunnel destination <Fortigate WAN1 IP>

 tunnel path-mtu-discovery

 tunnel protection ipsec profile test

!

Динамическая маршрутизация со стороны Fortigate:

FGT61 (ospf) # show

config router ospf

    set router-id 192.168.202.99

    config area

        edit 0.0.0.0

        next

    end

    config ospf-interface

        edit "FGT-Cisco-OSPF"

            set interface "FGT-Cisco"

            set dead-interval 40

            set hello-interval 10

            set mtu-ignore enable

            set network-type point-to-point

        next

        edit "FGT-Internal"

            set interface "internal"

            set dead-interval 40

            set hello-interval 10

        next

    end

    config network

        edit 1

            set prefix 192.168.202.0 255.255.255.0

        next

        edit 2

            set prefix 10.254.254.0 255.255.255.252

        next

        edit 3

            set prefix 192.168.253.0 255.255.255.0

        next

    end

    config redistribute "connected"

    end

    config redistribute "static"

    end

    config redistribute "rip"

    end

    config redistribute "bgp"

    end

    config redistribute "isis"

    end

end

Динамическая маршрутизация со стороны Сisco:

router ospf 1

 router-id 172.16.1.1

 network 10.254.254.0 0.0.0.3 area 0.0.0.0

 network 172.16.1.0 0.0.0.255 area 0.0.0.0

!

Cмотрим  что у нас с OSPFv2 на стороне Fortigate:

FGT61E # get router info ospf neighbor

OSPF process 0:

Neighbor ID     Pri   State           Dead Time   Address         Interface

172.16.1.1        1   Full/ -         00:00:36    10.254.254.2    FGT-Cisco_0

FGT61 # get router info routing-table ospf

O       172.16.1.0/24 [110/101] via 10.254.254.2, FGT-Cisco_0, 00:57:09

FGT61E # get router info ospf status

 Routing Process "ospf 0" with ID 192.168.202.99

 Process uptime is 7 days 15 hours 9 minutes

 Process bound to VRF default

 Conforms to RFC2328, and RFC1583Compatibility flag is disabled

 Supports only single TOS(TOS0) routes

 Supports opaque LSA

 Do not support Restarting

 SPF schedule delay 5 secs, Hold time between two SPFs 10 secs

 Refresh timer 10 secs

 Number of incomming current DD exchange neighbors 0/5

 Number of outgoing current DD exchange neighbors 0/5

 Number of external LSA 0. Checksum 0x000000

 Number of opaque AS LSA 0. Checksum 0x000000

 Number of non-default external LSA 0

 External LSA database is unlimited.

 Number of LSA originated 1

 Number of LSA received 303

 Number of areas attached to this router: 1

    Area 0.0.0.0 (BACKBONE)

        Number of interfaces in this area is 3(4)

        Number of fully adjacent neighbors in this area is 1

        Area has no authentication

        SPF algorithm last executed 00:59:05.510 ago

        SPF algorithm executed 88 times

        Number of LSA 2. Checksum 0x010d97

Cмотрим  что у нас с OSPFv2 на стороне Cisco:

c1841#sh ip route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is 10.10.1.254 to network 0.0.0.0

      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks

O        10.254.254.1/32 [110/1000] via 10.254.254.1, 01:00:16, Tunnel0

O     192.168.202.0/24 [110/1001] via 10.254.254.1, 00:57:30, Tunnel0

O     192.168.253.0/24 [110/1100] via 10.254.254.1, 01:00:16, Tunnel0

c1841#sh ip ospf

 Routing Process "ospf 1" with ID 172.16.1.1

 Start time: 00:00:59.996, Time elapsed: 6w3d

 Supports only single TOS(TOS0) routes

 Supports opaque LSA

 Supports Link-local Signaling (LLS)

 Supports area transit capability

 Supports NSSA (compatible with RFC 1587)

 Event-log enabled, Maximum number of events: 1000, Mode: cyclic

 Router is not originating router-LSAs with maximum metric

 Initial SPF schedule delay 5000 msecs

 Minimum hold time between two consecutive SPFs 10000 msecs

 Maximum wait time between two consecutive SPFs 10000 msecs

 Incremental-SPF disabled

 Minimum LSA interval 5 secs

 Minimum LSA arrival 1000 msecs

 LSA group pacing timer 240 secs

 Interface flood pacing timer 33 msecs

 Retransmission pacing timer 66 msecs

 Number of external LSA 0. Checksum Sum 0x000000

 Number of opaque AS LSA 0. Checksum Sum 0x000000

 Number of DCbitless external and opaque AS LSA 0

 Number of DoNotAge external and opaque AS LSA 0

 Number of areas in this router is 1. 1 normal 0 stub 0 nssa

 Number of areas transit capable is 0

 External flood list length 0

 IETF NSF helper support enabled

 Cisco NSF helper support enabled

 Reference bandwidth unit is 100 mbps

    Area BACKBONE(0.0.0.0)

        Number of interfaces in this area is 3 (1 loopback)

        Area has no authentication

        SPF algorithm last executed 01:02:07.372 ago

        SPF algorithm executed 16 times

        Area ranges are

        Number of LSA 2. Checksum Sum 0x022898

        Number of opaque link LSA 0. Checksum Sum 0x000000

        Number of DCbitless LSA 1

        Number of indication LSA 0

        Number of DoNotAge LSA 0

        Flood list length 0