One response to “FortiGate IPsec”

1. 

   Soroush

   April 28, 2026

   FortiGate IPsec VPN Manual (Step‑by‑Step for Dummies)
   What are we building?
   We will connect two offices securely over the Internet using IPsec VPN.
   Office A (HQ) ─── Internet ─── Office B (Branch)
   10.1.1.0/24 10.2.2.0/24

   Once finished:

   PCs in Office A can reach Office B
   Traffic is encrypted
   Works 24/7 automatically

   What you need BEFORE you start
   Prepare this first (very important):
   On both FortiGates

   ✅ Internet works
   ✅ Web GUI access
   ✅ Admin access

   Information you MUST know
   Write this down:

   ItemHQBranch
   Public IPe.g. 1.1.1.1e.g. 2.2.2.2
   LAN subnet10.1.1.0/2410.2.2.0/24
   WAN interfacewan1
   wan1Pre‑Shared KeySame on bothSame on both

   Important Concepts (simple explanation)
   Term Meaning
   Phase 1 Builds the secure tunnel
   Phase 2 Decides which networks can talk
   Pre‑Shared Key VPN password
   Wizard FortiGate helper (we use this!)

   STEP 1 – Login to FortiGate (HQ)

   Open browser
   Go to
   https://

   Login as admin

   🛠️ STEP 2 – Create the VPN (HQ side)
   Go to:
   VPN → IPsec Wizard → Create New

   Choose:

   ✅ Site to Site
   ✅ Custom
   Click Next

   Phase 1 – Basic Settings

   Field Value
   NameHQ_to_BranchRemote GatewayStatic IP AddressIP AddressBranch public IP (2.2.2.2)Interfacewan1Pre‑Shared Keye.g. MyStrongVPNkey123!

   Keep defaults unless told otherwise
   ✅ Click Next
   [kevindarian.com]

   🔐 Phase 2 – Encryption & Networks
   Local Network

   Type: Subnet
   Address: 10.1.1.0
   Mask: 255.255.255.0

   Remote Network

   Type: Subnet
   Address: 10.2.2.0
   Mask: 255.255.255.0

   Click Next

   🔥 Firewall Policy (VERY IMPORTANT)
   When asked:
   ✅ Create Firewall Policies = YES
   This allows traffic through the tunnel.
   Click Finish

   🔁 STEP 3 – Repeat on Branch FortiGate
   Now do the same steps, but swap networks.
   Changes on Branch:

   FieldValueNameBranch_to_HQRemote IPHQ public IP (1.1.1.1)Local subnet10.2.2.0/24Remote subnet10.1.1.0/24Pre‑Shared KeyExactly the same
   ✅ EVERYTHING ELSE SAME

   🧪 STEP 4 – Check Tunnel Status
   On either FortiGate:
   VPN → IPsec Tunnels

   You should see:

   ✅ Green UP arrow

   If not:

   Click Bring Up
   Or ping from one LAN to the other

   [docs.fortinet.com]

   ✅ STEP 5 – Test Connectivity
   From a PC in Office A:
   ping 10.2.2.10

   ✅ If it replies → VPN works

   🚑 Troubleshooting for Dummies
   ❌ Tunnel DOWN?
   Check these:

   ❗ Pre‑Shared Key identical
   ❗ Correct public IP
   ❗ WAN interface correct
   ❗ UDP 500 & 4500 allowed

   ❌ Tunnel UP but no traffic?

   Firewall policies created?
   Correct subnets?
   Any NAT enabled by mistake?

   🧾 Recommended Security Settings (Optional)
   Later improve security:

   IKE Version: IKEv2
   Encryption: AES256 / SHA256
   Enable Dead Peer Detection

   [docs.fortinet.com]

   📌 Quick Checklist
   ✅ Internet works
   ✅ Public IP reachable
   ✅ Same PSK on both sides
   ✅ Firewall rules created
   ✅ Correct subnets

   If you want, I can:

   ✅ Rewrite this as PDF / Word manual
   ✅ Add screenshots
   ✅ Do CLI version
   ✅ Create FortiGate‑to‑Cisco / Palo Alto guide
   ✅ Make a one‑page cheat sheet

   Just tell me 👍

   Reply