(optional) PFS – In this case I have not configured it. Make sure the phase 2 encryption and authentication match on both sides of the tunnel.Ĭonfigure Lifetime on the pfSense again ensuring that this matches on both end point devices. Set the remote network to the remote subnet of the Fortigate.Ģ.8 Configure Phase 2 Proposal (SA/Key Exchange) on the pfSense Set the local network to the local subnet connected to the pfSense. Make sure that the Phase2 Selectors are an exact mirror to the Fortigate:Ģ.7 Configure Phase 2 General Information on the pfSense You can leave this as the defaults valuesĢ.5 Configure Pre-shared Keys TAB at the Top of the pageĬlick the TAB labelled Pre-Shared Keys and enter your Pre-shared Key again and the Private IP address of the WAN interface remote device (Fortigate).Ģ.6 Click the green Add P2 to add the pfSense’s phase 2 configuration Also ensure that the timers match on either side.Ģ.4 Configure Advanced options on the pfSense Pre-Shared Key = Make sure that the Pre-Shared key matches on both sidesĢ.3 Configure Phase1 Proposal ( Encryption) on the pfSenseĮnsure that the Encryption Algorithms are an exact mirror on both devices.

Normally this would just be the Peer IP address if the Public IP address was configured on the Remote Fortigate. Peer Identifier = This is important and needs to be the Private IP address of the WAN interface of the Fortigate or remote device. Remote Gateway = The public IP address of the FortigateĢ.2 Configure Phase1 Proposal ( Authentication) on the pfSense This is a detailed guide on how to create a Site to Site IPSec VPN from a pfSense to a Fortigate behind a NAT Router.ġ.3 Configure a static route on the FortigateĬonfig router static set dst 10.0.100.0 255.255.255.0ġ.4 Configure Fortigate firewall policiesĢ.1 Configure Phase 1 General Information on the pfSense

Fortigate ipsec vpn site to site