---
title: "Setting up site-to-site on FortiGate"
slug: "site-to-site-fortigate"
description: "Open the FortiGate Management Interface in the left panel, select VPN, then IPsec Tunnels, and select Create New In the VPN Creation Wizard window set the Name to NordLayer."
updated: 2026-09-08T13:10:43Z
published: 2026-09-08T13:10:43Z
canonical: "help.nordlayer.com/site-to-site-fortigate"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up site-to-site on FortiGate

**Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

## Configuring the tunnel at the FortiGate Management Interface

1. Open the FortiGate Management Interface
2. In the left panel, select VPN, then IPsec Tunnels, and select Create New

![FortiGate VPN dashboard displaying IPsec tunnels with inactive status and wan2 interface bindings](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/01%20Setting%20up%20site-to-site%20on%20FortiGate(1).png)

1. In the VPN Creation Wizard window set the Name to NordLayer (or any other name you desire), the Template Type to Custom tab, and select Next

![FortiGate IPsec tunnel configuration showing IPv4 network settings with NAT traversal disabled](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/02%20Setting%20up%20site-to-site%20on%20FortiGate(1).png)

1. Fill in the following information:

### Network Section:

- **IP Version**: IPv4
- **Remote Gateway**: [Static IP Address](https://nordlayer.com/blog/what-is-static-ip/)
- **IP Address**: Insert the IP of your NordLayer server with a dedicated IP
- **Interface**: select your WAN interface
- **Mode Config**: unchecked
- **NAT Traversal**: Disable
- **Dead Peer Detection**: On-Demand

### Authentication section:

- **Method**: Pre-shared Key
- **Pre-shared Key**: Insert the generated Shared Key (we will also need this value on our end)
- **IKE Version**: 2
- **Mode**: Main (ID protection)

### Phase 1 Proposal section:

- **Encryption**: AES256
- **Authentication**: SHA256
- **Diffie-Hellman Group**: 14
- **Key Lifetime (seconds)**: 28800
- **Local ID**: leave blank
- **XAUTH Section**: leave disabled

### Phase 2 Selectors (+Advanced) section:

- **Name**: NordLayer
- **Local Address**: Your Local network Subnet
- **Remote Address**: 10.6.0.0/20 (255.255.240.0)
- **Enable Replay Detection**: Checked
- **Enable Perfect Forward Secrecy (PFS)**: Checked
- **Diffie-Hellman Group**: 14
- **Encryption**: AES256
- **Authentication**: SHA256
- **Local Port:** Checked
- **Remote Port**: Checked
- **Protocol**: Checked
- **Key Lifetime**: Seconds
- **Seconds**: 3600

## Configuring firewall and static routing

It is necessary to add static routes from the NordLayer subnet (10.6.0.0/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0/20).

![FortiGate static routes table showing IPv4 and IPv6 network configurations with wan2 interface](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/03%20Setting%20up%20site-to-site%20on%20FortiGate(1).png)

1. Go to Network -> Routing -> Static Routes -> Create new -> Route

![FortiGate new static route form with NordLayer device and subnet destination configured](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/04%20Setting%20up%20site-to-site%20on%20FortiGate(1).webp)

1. Set Destination to 10.6.0.0/20 and the Device: NordLayer (or any other name you chose for the tunnel)
2. Select OK
3. It is necessary to add firewall rules to allow traffic from the NordLayer subnet (10.6.0.0/20) to your local network or services you desire
4. Go to Policy & Objects -> IPv4 Policy and select Create New
5. Fill in the following information:

- **Name**: NordLayer
- **Incoming Interface**: NordLayer
- **Outgoing Interface**: Your local network object
- **Source**: All
- **Destination**: All
- **Schedule**: Always
- **Service**: All
- **NAT**: Disabled

If any additional settings appear, leave them in their default status.

1. Select OK

## Make sure the tunnel is up

At the FortiGate Management Interface, go to VPN -> IPSec Tunnels. If the tunnel is up the line will appear in the table:

![FortiGate IPsec tunnel entry showing NordLayer configured on wan2 with one active connection](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/05%20Setting%20up%20site-to-site%20on%20FortiGate(1).png)

## Ending note:

In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site).

- Pre-shared key - you can generate it or we can provide it
- Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
- Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
- Remote subnet and mask (the subnet is used in your local network)

---

**Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.