Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configuring a CloudBridge Connector tunnel between a NetScaler appliance and fortinet fortiGate appliance

May 2, 2023
Contributed by: 
S

You can configure a CloudBridge Connector tunnel between a NetScaler appliance and a Fortinet FortiGate appliance to connect two datacenters or extend your network to a cloud provider. The NetScaler appliance and the FortiGate appliance form the end points of the CloudBridge Connector tunnel and are called peers.

Example of a CloudBridge Connector Tunnel Configuration

As an illustration of the traffic flow in a CloudBridge Connector tunnel, consider an example in which a CloudBridge Connector tunnel is set up between the following devices:

  • NetScaler appliance NS_Appliance-1 in a datacenter designated as Datacenter-1
  • FortiGate appliance FortiGate-Appliance-1 in a datacenter designated as Datacenter-2

NS_Appliance-1 and FortiGate-Appliance-1 enable communication between private networks in Datacenter-1 and Datacenter-2 through the CloudBridge Connector tunnel. In the example, NS_Appliance-1 and FortiGate-Appliance-1 enable communication between client CL1 in Datacenter-1 and server S1 in Datacenter-2 through the CloudBridge Connector tunnel. Client CL1 and server S1 are on different private networks.

On NS_Appliance-1, the CloudBridge Connector tunnel configuration includes IPSec profile entity NS_Fortinet_IPSec_Profile, CloudBridge Connector tunnel entity NS_Fortinet_Tunnel, and policy based routing (PBR) entity NS_Fortinet_Pbr.

localized image

For more information, see CloudBridge Connector tunnel configuration table pdf.

For information about Settings on Fortinet FortiGate-Appliance-1 in Datacenter-2, see table.

Points to consider for a CloudBridge Connector tunnel configuration

Before configuring a CloudBridge Connector tunnel between a NetScaler appliance and a FortiGate appliance, consider the following points:

  • The following IPSec settings are supported for a CloudBridge Connector tunnel between a NetScaler appliance and a FortiGate appliance.

    IPSec Properties Settings
    IPSec mode Tunnel mode
    IKE version Version 1
    IKE DH group DH group 2 (1024 bits MODP algorithm)
    IKE authentication method Pre-Shared Key
    IKE encryption algorithm AES
    IKE hash algorithm HMAC SHA1
    ESP encryption algorithm AES
    ESP hash algorithm HMAC SHA1
  • You must specify the same IPSec settings on the NetScaler appliance and the FortiGate appliance at the two ends of the CloudBridge Connector.
  • NetScaler provides a common parameter (in IPSec profiles) for specifying an IKE hash algorithm and an ESP hash algorithm. It also provides another common parameter for specifying an IKE encryption algorithm and an ESP encryption algorithm. Therefore in the FortiGate appliance, you must specify the same hash algorithm and same encryption algorithm in IKE (phase 1 configuration) and ESP (phase 2 configuration).
  • You must configure the firewall at the NetScaler end and FortiGate end to allow the following.
    • Any UDP packets for port 500
    • Any UDP packets for port 4500
    • Any ESP (IP protocol number 50) packets
  • FortiGate appliance supports two types of VPN tunnels: Policy-based and Route-based. Only policy-based VPN tunnel is supported between a FortiGate appliance and a NetScaler appliance.

Configuring FortiGate appliance for the CloudBridge Connector tunnel

To configure a CloudBridge Connector tunnel on a FortiGate appliance, use the Fortinet Web-based Manager, which is the primary user interface for configuring, monitoring, and maintaining FortiGate appliances.

Before you begin the CloudBridge Connector tunnel configuration on a FortiGate appliance, make sure that:

  • You have a user account with administrator credentials on the FortiGate appliance.
  • You are familiar with the Fortinet Web-based Manager.
  • The FortiGate appliance is UP and running, is connected to the Internet, and is also connected to the private subnets whose traffic is to be protected over the CloudBridge Connector tunnel.

Note

The procedures for configuring CloudBridge Connector tunnel on a FortiGate appliance might change over time, depending on the Fortinet release cycle. Citrix recommends that you follow the official Fortinet product documentation for Configuring IPSec VPN tunnels.

To configure a CloudBridge connector tunnel between a NetScaler appliance and a FortiGate appliance, perform the following tasks on the FortiGate appliance by using the Fortinet Web-based manager:

  • Enable Policy-based IPSec VPN feature. Enable this feature for creating policy-based VPN tunnels on the FortiGate appliance. Only policy-based type of VPN tunnel is supported between a FortiGate appliance and a NetScaler appliance. A policy-based VPN tunnel configuration on a FortiGate appliance includes phase 1 settings, phase 2 settings, and an IPSec security policy.
  • Define phase 1 parameters. Phase 1 parameters are used by the FortiGate appliance for IKE Authentication before forming a secure tunnel to the NetScaler appliance.
  • Define phase 2 parameters. Phase 2 parameters are used by the FortiGate appliance for forming a secure tunnel to the NetScaler appliance by establishing IKE security associations (SA).
  • Specify private subnets. Define the FortiGate-side and the NetScaler-side private subnets whose IP traffic is to be transported through the tunnel.
  • Define an IPSec security policy for the tunnel. A security policy allow IP traffic to pass between interfaces on a FortiGate appliance. An IPSec security policy specifies the interface to the private subnet and the interface connecting the NetScaler appliance through the tunnel.

To enable Policy-based IPSec VPN feature by using the Fortinet Web-based Manager

  1. Navigate to System > Config > Features.
  2. On the Feature Settings page, select Show More and turn on Policy-based IPSec VPN.

To define phase 1 parameters by using the Fortinet Web-based Manager

  1. Navigate to VPN > IPsec > Auto Key (IKE) and click Create Phase1.
  2. On the New Phase 1 page, set the following parameters:
    • Name: Enter a name for this phase 1 configuration.
    • Remote Gateway: Select Static IP Address.
    • Mode: Select Main (ID Protection).
    • Authentication Method: Select Preshared Key.
    • Pre-Shared Key: Enter a pre-shared key. The same pre-shared key must be configured on the NetScaler appliance.
    • Peer Options: Set the following IKE paramters for authenticating a NetScaler appliance.
      • IKE Version: Select 1.
      • Mode Config: Clear this option if it is selected.
      • Local Gateway IP: Select Main Interface IP.
      • P1 Proposal: Select the encryption and authentication algorithms for IKE Authentication before forming a secure tunnel to the NetScaler appliance.
        • 1 - Encryption: Select AES128.
        • Authentication: Select SHA1.
        • Keylife: Enter an amount of time (in seconds) for the phase 1 key life.
        • DH Group: Select 2.
      • X-Auth: Select Disable.
      • Deed Peer Detection: Select this option.
  3. Click OK.

To specify private subnets by using the Fortinet Web-based Manager

  1. Navigate to Firewall Objects > Address > Addresses and select Create New.
  2. On the New Address page, set the following parameters:
    • Name: Enter a name for FortiGate-side subnet.
    • Type: Select Subnet.
    • Subnet / IP Range: Enter the address of the FortiGate-side subnet.
    • Interface: Select the local interface to this subnet.
  3. Click OK.
  4. Repeat steps 1-3 to specify the NetScaler-side subnet.

To define phase 2 parameters by using the Fortinet Web-based Manager

  1. Navigate to VPN > IPsec > Auto Key (IKE) and click Create Phase 2.
  2. On the New Phase 2 page, set the following parameters:
    • Name: Enter a name for this phase 2 configuration.
    • Phase 1: Select the Phase 1 configuration from the drop-down list.
  3. Click Advanced and set the following parameters:
    • P2 Proposal: Select the encryption and authentication algorithms for forming a secure tunnel to the NetScaler appliance.
      • 1 - Encryption: Select AES128.
      • Authentication: Select SHA1.
      • Enable replay detection: Select this option.
      • Enable perfect forward secrecy (PFS): Select this option.
      • DH Group: Select 2.
    • Keylife: Enter an amount of time (in seconds) for the phase 2 key life.
    • Autokey Keep Alive: Select this option.
    • Auto-negotiate: Select this option.
    • Quick Mode Selector: Specify the FortiGate-side and the NetScaler-side private subnets whose traffic is to be traversed through the tunnel.
      • Source Address: Select the FortiGate-side subnet from the drop-down list.
      • Source Port: Enter 0.
      • Destination Address: Select the NetScaler-side subnet from the drop-down list.
      • Destination Port: Enter 0.
      • Protocol: Enter 0.
  4. Click OK.

To define an IPSec security policy by using the Fortinet Web-based Manager

  1. Navigate to Policy > Policy > Policy and click Create New.
  2. On the Edit Policy page, set the following parameters:
    • Policy Type: Select VPN.
    • Policy Subtype: Select IPSec.
    • Local Interface: Select the local interface to the internal (private) network.
    • Local Protected Subnet: Select the FortiGate-side subnet from the drop-down list whose traffic is to be traversed through the tunnel.
    • Outgoing VPN Interface: Select the local interface to the external (public) network.
    • Remote Protected Subnet: Select the NetScaler-side subnet from the drop-down list whose traffic is to be traversed through the tunnel.
    • Schedule: Keep the default setting (always) unless changes are needed to meet specific requirements.
    • Service: Keep the default setting (ANY) unless changes are needed to meet your specific requirements.
    • VPN Tunnel: Select Use Existing and select the tunnel from the drop-down list.
    • Allow traffic to be initiated from the remote site: Select if traffic from the remote network will be allowed to initiate the tunnel.
  3. Click OK.

Configuring the NetScaler appliance for the CloudBridge Connector tunnel

To configure a CloudBridge Connector tunnel between a NetScaler appliance and a FortiGate appliance, perform the following tasks on the NetScaler appliance. You can use either the NetScaler command line or the NetScaler graphical user interface (GUI):

  • Create an IPSec profile. An IPSec profile entity specifies the IPSec protocol parameters, such as IKE version, encryption algorithm, hash algorithm, and authentication method to be used by the IPSec protocol in the CloudBridge Connector tunnel.
  • Create an IP tunnel that uses IPSec protocol, and associate the IPSec profile with it. An IP tunnel specifies the local IP address (CloudBridge Connector tunnel end point IP address (of type SNIP) configured on the NetScaler appliance), remote IP address (CloudBridge Connector tunnel endpoint IP address configured on the FortiGate appliance), protocol (IPSec) used to set up the CloudBridge Connector tunnel, and an IPSec profile entity. The created IP tunnel entity is also called the CloudBridge Connector tunnel entity.
  • Create a PBR rule and associate it with the IP tunnel. A PBR entity specifies a set of rules and an IP tunnel (CloudBridge Connector tunnel) entity. The source IP address range and the destination IP address range are the conditions for the PBR entity. Set the source IP address range to specify the NetScaler-side subnet whose traffic is to be protected over the tunnel, and set the destination IP address range to specify the FortiGate appliance side subnet whose traffic is to be protected over the tunnel.

To create an IPSEC profile by using the NetScaler command line

At the command prompt, type:

  • add ipsec profile <name> -psk <string> -ikeVersion v1 -encAlgo AES -hashAlgo HMAC_SHA1 -perfectForwardSecrecy ENABLE
  • show ipsec profile <name>

To create an IPSEC tunnel and bind the IPSEC profile to it by using the NetScaler command line

At the command prompt, type:

  • add ipTunnel <name> <remote> <remoteSubnetMask> <local> -protocol IPSEC –ipsecProfileName** <string>
  • show ipTunnel <name>

To create a PBR rule and bind the IPSEC tunnel to it by using the NetScaler command line

At the command prompt, type:

  • add pbr <pbrName> ALLOW –srcIP <subnet-range> -destIP <subnet-range> -ipTunnel <tunnelName>
  • apply pbrs
  • show pbr <pbrName>

To create an IPSEC profile by using the GUI

  1. Navigate to System > CloudBridge Connector > IPSec Profile.
  2. In the details pane, click Add.
  3. In the Add IPSec Profile page, set the following parameters:
    • Name
    • Encryption Algorithm
    • Hash Algorithm
    • IKE Protocol Version
    • Perfect Forward Secrecy (Enable this paramter)
  4. Configure the IPSec authentication method to be used by the two CloudBridge Connector tunnel peers to mutually authenticate: Select the Pre-shared key authentication method and set the Pre-Shared Key Exists parameter.
  5. Click Create, and then click Close.

To create an IP tunnel and bind the IPSEC profile to it by using the GUI

  1. Navigate to System > CloudBridge Connector > IP Tunnels.
  2. On the IPv4 Tunnels tab, click Add.
  3. In the Add IP Tunnel page, set the following parameters:
    • Name
    • Remote IP
    • Remote Mask
    • Local IP Type (In the Local IP Type drop-down list, select Subnet IP).
    • Local IP (All the configured IP addresses of the selected IP type are in the Local IP drop down list. Select the desired IP from the list.)
    • Protocol
    • IPSec Profile
  4. Click Create, and then click Close.

To create a PBR rule and bind the IPSEC tunnel to it by using the GUI

  1. Navigate to System > Network > PBR.
  2. On the PBR tab, click Add.
  3. In the Create PBR page, set the following parameters:
    • Name
    • Action
    • Next Hop Type (Select IP Tunnel)
    • IP Tunnel Name
    • Source IP Low
    • Source IP High
    • Destination IP Low
    • Destination IP High
  4. Click Create, and then click Close.

The corresponding new CloudBridge Connector tunnel configuration on the NetScaler appliance appears in the GUI.

The current status of the CloudBridge connector tunnel is shown in the Configured CloudBridge Connector pane. A green dot indicates that the tunnel is up. A red dot indicates that the tunnel is down.

The following commands create settings of NetScaler appliance NS_Appliance-1 in “Example of a CloudBridge Connector Configuration.”

    >  add ipsec profile NS_Fortinet_IPSec_Profile -psk  examplepresharedkey -ikeVersion v1 –encAlgo AES –hashalgo HMAC_SHA1 –lifetime 315360 -perfectForwardSecrecy ENABLE

     Done
    >  add iptunnel NS_Fortinet_Tunnel 203.0.113.200 255.255.255.255 198.51.100.100 –protocol IPSEC –ipsecProfileName NS_Fortinet_IPSec_Profile

     Done
    > add pbr NS_Fortinet_Pbr -srcIP 10.102.147.0-10.102.147.255 –destIP 10.20.0.0-10.20.255.255 –ipTunnel NS_Fortinet_Tunnel

     Done
    > apply pbrs

     Done
<!--NeedCopy-->

Monitoring the CloudBridge Connector tunnel

You can monitor the performance of CloudBridge Connector tunnels on a NetScaler appliance by using CloudBridge Connector tunnel statistical counters. For more information about displaying CloudBridge Connector tunnel statistics on a NetScaler appliance, see Monitoring CloudBridge Connector Tunnels.

Configuring a CloudBridge Connector tunnel between a NetScaler appliance and fortinet fortiGate appliance
May 2, 2023
Contributed by: 
S
May 2, 2023
Contributed by: 
S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.