Setting up site-to-site on FortiGate

Note: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

Configuring the tunnel at the FortiGate Management Interface

1. Open the FortiGate Management Interface

2. In the left panel, select VPN, then IPsec Tunnels, and select Create New

3. In the VPN Creation Wizard window set the Name to NordLayer (or any other name you desire), the Template Type to Custom tab, and select Next

4. Fill in the following information:

Network Section:

• IP Version: IPv4
• Remote Gateway: Static IP Address
• IP Address: Insert the IP of your NordLayer server with a dedicated IP
• Interface: select your WAN interface
• Mode Config: unchecked
• NAT Traversal: Disable
• Dead Peer Detection: On-Demand

Authentication section:

• Method: Pre-shared Key
• Pre-shared Key: Insert the generated Shared Key (we will also need this value on our end)
• IKE Version: 2
• Mode: Main (ID protection)

Phase 1 Proposal section:

• Encryption: AES256
• Authentication: SHA256
• Diffie-Hellman Group: 14
• Key Lifetime (seconds): 28800
• Local ID: leave blank
• XAUTH Section: leave disabled

Phase 2 Selectors (+Advanced) section:

• Name: NordLayer
• Local Address: Your Local network Subnet
• Remote Address: 10.6.0.0/20 (255.255.240.0)
• Enable Replay Detection: Checked
• Enable Perfect Forward Secrecy (PFS): Checked
• Diffie-Hellman Group: 14
• Encryption: AES256
• Authentication: SHA256
• Local Port: Checked
• Remote Port: Checked
• Protocol: Checked
• Key Lifetime: Seconds
• Seconds: 3600

Configuring firewall and static routing

It is necessary to add static routes from the NordLayer subnet (10.6.0.0/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0/20).

1. Go to Network -> Routing -> Static Routes -> Create new -> Route

2. Set Destination to 10.6.0.0/20 and the Device: NordLayer (or any other name you chose for the tunnel)

3. Select OK

4. It is necessary to add firewall rules to allow traffic from the NordLayer subnet (10.6.0.0/20) to your local network or services you desire

5. Go to Policy & Objects -> IPv4 Policy and select Create New

6. Fill in the following information:

• Name: NordLayer
• Incoming Interface: NordLayer
• Outgoing Interface: Your local network object
• Source: All
• Destination: All
• Schedule: Always
• Service: All
• NAT: Disabled

If any additional settings appear, leave them in their default status.

7. Select OK

Make sure the tunnel is up

At the FortiGate Management Interface, go to VPN -> IPSec Tunnels. If the tunnel is up the line will appear in the table:

Ending note:

In order to finalize the site-to-site tunnel, please create a setup in Sites tab of the NordLayer Control Panel.

• Pre-shared key - you can generate it or we can provide it
• Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
• Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
• Remote subnet and mask (the subnet is used in your local network)

Note: In case you have any questions or issues, press 'Chat with support' at the bottom of the page.