Basic setup: Site to Site VPN - FortiGate to Sonic Wall

[#1]

Description
Steps required to set up basic site to site VPN between a FortiGate running FortiOS 3.0 in NAT mode and a SonicWALL Firewall device.

Important : Fortinet is not a service provider for SonicWALL equipment and is in no way responsible for any setup questions or deficiencies found within said devices.  Fortinet support will only be responsible for technical aspects of FortiGate device problem solving and troubleshooting.
Scope

FortiGate running in NAT mode. FortiOS 3.0.

SonicWALL device (not specific).

Solution

FortiGate Device Setting

To configure the Phase1 settings

1. Go to VPN > IPSec > Phase 1.
2. Select Create New and enter the following:

Gateway Name: ToSonicWall
Remote Gateway: SonicWall Static Public IP Address
IP Address: Public IP Address

Local Interface: Wan1 (if it is public interface)
Mode: Main
Authentication Method: Preshared Key
Preshared Key: preshared key

3. Select Advanced and enter the following:
   
   Encryption: 3DES
   Authentication: SHA1
   DH Group: 2
   Keylife: 28800
   
   Dead Peer Detection: Disabled
   
   Leave all other settings as default.
4. Select OK.

To configure the Phase 2 settings

1. Go to VPN > IPSec > Phase 2.
2. Select Create New and enter the following:
   
   Tunnel Name: SonicWallP2
   Remote Gateway: Select ToSonicWall
3. Select Advanced and enter the following:
   
   Encryption: 3DES
   Authentication: SHA1
   Enable replay detection : Unchecked
   DH group: 2
   Keylife: 28800
   Autokey Keep Alive : Checked
   Quick Mode Selector
   Source address: Internal LAN Subnet
   Destination address: Remote LAN Subnet
4. Select OK.

To add the addresses

1. Go to Firewall > Address.
2. Select Create New to create the FortiGate address.
3. Enter a name for the address, for example FortiGate_network.
4. Enter the FortiGate IP address and subnet. “ Internal LAN Subnet ”
5. Select OK.
6. Select Create New again to create the SonicWALL address.
7. Enter the name for the address, for example SonicWALL_network.
8. Enter the SonicWall IP address and subnet. “ Remote LAN Subnet ”
9. Select OK.

To create a firewall policy for the VPN traffic going from the SonicWALL device to the FortiGate unit

1. Go to Firewall > Policy.
2. Select Create New and set the following:
   
   Source Interface: Internal
   Source IP address: Internal LAN Subnet
   Destination Interface: WAN1 (or external)
   Destination Address Name: Remote LAN Subnet
   Schedule: always
   Service: ANY
   Action: Encrypt
   VPN Tunnel: ToSonicWall
   Select Allow inbound
   Select Allow outbound
3. Select OK

Configure the SonicWALL Device

1. Go to “General” tab.
2. Under Security Policy

Authentication Method: IKE using Preshared Secret
Name: ToFortiGate
IPSec Primary Gateway Name or Address: FortiGate Public IP Address

IKE Authentication
Shared Secret: preshared key
Confirm Share Secret: preshared key

            Others leave to default.

3. Create 2 addresses Internal LAN Subnet and Remote LAN Subnet.
4. Go to “Network” tab.

Local Networks
      Choose local network from list : Internal LAN Subnet

Choose local network from list : Remote LAN Subnet

5.   Go to “Proposals” tab.

            IKE (Phase 1) Proposal
            Exchange: Main Mode
            DH Group: Group2
            Encryption: 3DES
            Authentication: SHA1
            Life Time(seconds): 28800

            IPSec (Phase 2) Proposal
            Protocol: ESP
            Encryption: 3DES
            Authentication: SHA1
            Enable Perfect Forward Secrecy: Checked
            DH Group: Group2
            Life Time (seconds): 28800

    6.   Go to “Advanced” tab.

            Enable: Keep Alive