Once finished:

PCs in Office A can reach Office B
Traffic is encrypted
Works 24/7 automatically

What you need BEFORE you start
Prepare this first (very important):
On both FortiGates

✅ Internet works
✅ Web GUI access
✅ Admin access

Information you MUST know
Write this down:

ItemHQBranch
Public IPe.g. 1.1.1.1e.g. 2.2.2.2
LAN subnet10.1.1.0/2410.2.2.0/24
WAN interfacewan1
wan1Pre‑Shared KeySame on bothSame on both

Important Concepts (simple explanation)
Term Meaning
Phase 1 Builds the secure tunnel
Phase 2 Decides which networks can talk
Pre‑Shared Key VPN password
Wizard FortiGate helper (we use this!)

STEP 1 – Login to FortiGate (HQ)

Open browser
Go to
https://

Login as admin

🛠️ STEP 2 – Create the VPN (HQ side)
Go to:
VPN → IPsec Wizard → Create New

Choose:

✅ Site to Site
✅ Custom
Click Next

Phase 1 – Basic Settings

Field Value
NameHQ_to_BranchRemote GatewayStatic IP AddressIP AddressBranch public IP (2.2.2.2)Interfacewan1Pre‑Shared Keye.g. MyStrongVPNkey123!

Keep defaults unless told otherwise
✅ Click Next
[kevindarian.com]

🔐 Phase 2 – Encryption & Networks
Local Network

Type: Subnet
Address: 10.1.1.0
Mask: 255.255.255.0

Remote Network

Type: Subnet
Address: 10.2.2.0
Mask: 255.255.255.0

Click Next

🔥 Firewall Policy (VERY IMPORTANT)
When asked:
✅ Create Firewall Policies = YES
This allows traffic through the tunnel.
Click Finish

🔁 STEP 3 – Repeat on Branch FortiGate
Now do the same steps, but swap networks.
Changes on Branch:

FieldValueNameBranch_to_HQRemote IPHQ public IP (1.1.1.1)Local subnet10.2.2.0/24Remote subnet10.1.1.0/24Pre‑Shared KeyExactly the same
✅ EVERYTHING ELSE SAME

🧪 STEP 4 – Check Tunnel Status
On either FortiGate:
VPN → IPsec Tunnels

You should see:

✅ Green UP arrow

If not:

Click Bring Up
Or ping from one LAN to the other

[docs.fortinet.com]

✅ STEP 5 – Test Connectivity
From a PC in Office A:
ping 10.2.2.10

✅ If it replies → VPN works

🚑 Troubleshooting for Dummies
❌ Tunnel DOWN?
Check these:

❗ Pre‑Shared Key identical
❗ Correct public IP
❗ WAN interface correct
❗ UDP 500 & 4500 allowed

❌ Tunnel UP but no traffic?

Firewall policies created?
Correct subnets?
Any NAT enabled by mistake?

🧾 Recommended Security Settings (Optional)
Later improve security:

IKE Version: IKEv2
Encryption: AES256 / SHA256
Enable Dead Peer Detection

[docs.fortinet.com]

📌 Quick Checklist
✅ Internet works
✅ Public IP reachable
✅ Same PSK on both sides
✅ Firewall rules created
✅ Correct subnets

If you want, I can:

✅ Rewrite this as PDF / Word manual
✅ Add screenshots
✅ Do CLI version
✅ Create FortiGate‑to‑Cisco / Palo Alto guide
✅ Make a one‑page cheat sheet

Just tell me 👍