On Sat, Feb 09 2008 at 00:10, Chris Jones wrote:

quoted text
> Hi all,

Hi,

> A while back I attempted to setup a route-based VPN tunnel between a

quoted text
> Fortigate firewall and an OpenBSD firewall with no success. I now have the

> need to get this to work and wondering if someone on the list can shed some

> light on the configuration. The end goal is to have a gif(4) interface run

> over IPSec so that I can use a dynamic routing protocol to route traffic to

> remote VPN networks.

>

> I can successfully create an IPSec VPN connection between the Fortigate and

> OpenBSD 4.2 system. Normally the tunnel interfaces on Fortigates and

> Netscreens are un-numbered.

>

> I have tried bringing up the gif interface after successfully establishing

> an IPSec connection by issuing the following commands.

>

> $ sudo ifconfig gif0 create

> $ sudo ifconfig gif0 tunnel 1.1.1.1 2.2.2.2

> $ sudo ifconfig gif0 10.0.0.3 10.0.0.2 prefixlen 32

> $ sudo route add -inet 10.2.0.0/16 10.0.0.2

>

> I then modified the un-numbered tunnel interface on the Fortigate side to

> use src 10.0.0.2 dst 10.0.0.3. This didn't seem right to begin with as I

> already have an IPSec tunnel established. Where I'm confused is setting up

> gif to tunnel over the IPSec connection in order route traffic across it.

> Can someone point me in the right direction.

"Routed VPN" in Netscreen and Fortinet is done by modifying the way ipsec

should work. It's not the way to go if you want to take the vpn decision

based on ip routes.

I'd firstly try to create a GRE tunnel (numbered) between peers and then

create a host to host vpn with GRE tunnel on top of it. 
Both OpenBSD and Netscreen support GRE, I hope Fortinet does.
Claer
> My setup is quite simple.

quoted text
>

> network

> -------

>

> internal      external                external   internal

> ----------- | -------- -> Internet -> -------- | -----------

> 10.1.1.0/24   1.1.1.1                 2.2.2.2    10.2.0.0/16

>

>

> ipsec.conf

> ----------

>

> remote_gw = "2.2.2.2"

>

> ike dynamic esp from 10.1.1.0/24 to 10.2.0.0/16 peer $remote_gw \

>         aggressive auth hmac-sha1 enc 3des group modp1536 \

>         quick auth hmac-sha1 enc 3des group modp1536 \

>         srcid foo@foo.com \

>         psk "secret"

>

>

> Thanks,

> -Chris

>

> --

> Chris Jones