Configuring Fortinet SD-WAN

Sign into the Fortinet Administrator Portal.

Go to VPN > IPsec Tunnels.

Select Create New > IPsec Tunnel.

Set Template type to Custom.

In the Name field, enter a name for the VPN tunnel.

For example: TO_Cloud_Prim

To set the network settings:

1. From the Remote Gateway drop-down list, select Dynamic DNS.

2. In the Dynamic DNS field, enter the FQDN from the Harmony Connect Portal.

   For example: s1-a98dfc4c6e19e5593b87ac42bc8672df.checkpoint.cloud.

3. From the Interface drop-down list, select an incoming interface to wan1.

   

Under Authentication:

1. From the Method drop-down list, select Pre-shared Key.

2. In the Pre-shared key field, enter the key value from the Harmony Connect Portal.

3. Under IKE, set Version as 2.

   

Under Phase 1 Proposal:

1. From the Encryption drop-down list, select AES256.

2. From the Authentication drop-down list, select SHA1.

3. Set Diffie-Hellman Group as 2.

4. In the Key Lifetime (seconds), enter 86400.

   

Under Phase 2 Selectors:

1. In Local Address field, enter the local IP/Network.

   For Example: 172.18.30.0/255.255.255.0.

2. In Remote Address field, enter 0.0.0.0/0.0.0.0.

Under Phase 2 Proposal:

1. From the Encryption drop-down list, select AES256.

2. From the Authentication drop-down list, select SHA1.

3. Set Enable Replay Detection, Local Port, Remote Port, and Protocol checkboxes as All.

4. Enable Auto-negotiate checkbox.

5. From the Key Lifetime drop-down list, select Seconds.

6. In the Seconds field, enter 3600.

   

Select OK.

Repeat the steps to create the second tunnel.

Go to Network > Policy Routes and select Policy Route.

In the Incoming interface, select Vlan/Lan.

For example: lan30.

Under Source Address, enter the IP/Network.

For example: 172.18.30.0/255.255.255.0.

Under Destination Address, enter the IP/Network value as 0.0.0.0/0.0.0.0.

Set Protocol as Any.

Under Then, set Action as Forward Traffic.

Enable Outgoing interface and select the first VPN Tunnel.

For example: TO_Cloud_Prim.

In the Gateway address, enter the value 0.0.0.0.

Set Status as Enabled.

Select OK.

Go to Network > Static Routes and select Static Route.

Set the Destination as Subnet.

From the Interface drop-down list, select the first VPN tunnel.

For example: To_Cloud_Prim

Set the Status as Enabled.

Select OK.

Go to Policy & Objects > Firewall Policy and select New Policy.

In the Name field, enter a policy name.

For example To_Cloud_Primary

In Incoming Interface, select Vlan/Lan.

For example lan30.

In Outgoing interface, select the first VPN tunnel.

For example To_Cloud_Prim.

In Source, select the network address.

For example: Vlan30.

Set the Destination as All.

Set Schedule as Always.

Set Service as ALL.

Set Action as Accept.

Disable NAT.

Enable Log Allowed Traffic and select All Sessions.

Select Enable this policy.

Select OK.