Item

Athena NGFW

Fortinet

IKE SA

- IKE version: v1

- Negotiation mode: main mode

- Authentication method: pre-shared key (PSK)

- Algorithms: AES+SHA1

- Diffie-Hellman (DH) group: group2

- IKE version: v1

- Negotiation mode: main mode

Authentication method: PSK

- Algorithms: AES128 (AES)+SHA256, AES256+SHA256 (SHA2-25), AES128 (AES)+SHA1, and AES256 (SHA2-256)+SHA1

- DH groups: group14 and group5

IPsec SA

- Security protocol: Encapsulating Security Payload (ESP)

- Algorithms: AES+SHA1, AES256+SHA1, DES+SHA1, DES+SHA2-256, AES+SHA2-256, and AES256+SHA2-256

- Perfect forward secrecy (PFS): None

- Encapsulation mode: tunnel mode

- Security protocol: ESP

- Algorithms: AES128 (AES)+SHA1, AES256+SHA1, AES128 (AES)+SHA256 (SHA2-256), AES256+SHA256 (SHA2-256), AES128GCM, AES256GCM, and CHACHA20POLY1305

- PFS: group14 and group5

- Encapsulation mode: tunnel mode

Configuration Item (Athena NGFW)

Description

Local ID Type: USER_FQND and DN

Fortinet does not support these ID types. If a local ID is needed, we recommend that you select ADDR or FQDN as the ID type.

DH Group: group22, group23, group24, group25, and group26

Fortinet does not support these DH groups. We recommend that you use other DH groups, which do not affect IPsec VPN tunnel establishment.

Encryption Algorithm: AES192-GCM, SANGFOR_DES, SM1, and SM4

- Fortinet does not support these encryption algorithms. We recommend that you use other encryption algorithms, which do not affect IPsec VPN tunnel establishment.

- SANGFOR_DES is Sangfor's proprietary cryptographic algorithm, which applies only to Sangfor devices.

- SM1 and SM4 are China's commercial cryptographic algorithms, which are mainly used in China. SM1 is supported only on physical commercial cryptographic devices.

- GCM is supported only in IKEv2 mode.

Traffic of Interest

- By default, IPv4 is enabled, which is equivalent to a case where the local- and peer-end IPv6 addresses are all-0 addresses. In this case, we recommend that you configure a single selector whose IPv4 address is an all-0 address on the peer Fortinet firewall.

- IPv6 is enabled, which is equivalent to a case where the local- and peer-end IPv6 addresses are all-0 addresses. In this case, we recommend that you configure a single selector whose IPv6 address is an all-0 address on the peer Fortinet firewall.

Peer Tunnel Interface

- If the referenced VPN tunnel interface is not shared with other IPsec VPN tunnels, we recommend that you leave this configuration item empty.

- You must enter the address of the peer tunnel interface if OSPF or BGP is used.

- When you need to specify the next hop for the static route or policy route, make sure that the next hop address is the same as the peer tunnel interface address of the IPsec VPN tunnel. Otherwise, business traffic may fail to be routed.

Encrypted Traffic

- This is equivalent to a phase 2 selector in Fortinet. The local and peer IP addresses in the encrypted traffic can be customized only in policy mode. You cannot customize the local and peer IP addresses in route mode. In addition, only two encrypted traffic entries are predefined: one using an all-0 IPv4 address and the other using an all-0 IPv6 address. By default, IPv4 is enabled, and the traffic to be actually encrypted is determined by the address specified in the traffic of interest.

- In policy mode, multiple local/peer IP addresses can be configured in the encrypted traffic. To be specific, a maximum of 16 * 16 addresses can be configured.

- In policy mode, if IKEv1 is used and multiple local/peer IP addresses are configured in the encrypted traffic, we recommend that you configure multiple selectors on Fortinet and set the local/peer IP address to a netmask. If you want to configure only one selector on Fortinet, we recommend that you switch to IKEv2 and set the address type to Named Address (Address Group). According to the IPSec VPN standard protocol, IKEv1 splits multiple addresses into multiple SAs for negotiation. However, Fortinet does not perform such a split according to the standard when named addresses are used.

Strict MID Check

This is a proprietary feature, which is disabled by default. It is mainly used to adapt to Microsoft Azure. We recommend that you disable it.

Local Intranet Service

Peer Intranet Service

These are proprietary features, which are used to limit the types of traffic allowed on the local and peer ends. These features are available only in policy mode. We recommend that you use the default settings.

Phase 2 Proposal: AH

Fortinet does not support Authentication Header (AH). You can use ESP, which does not affect IPsec VPN tunnel establishment.

Route Priority

This is a proprietary feature, which is used to create primary and secondary IPsec VPNs. This feature is available only in policy mode.

SPI Merging

This is a proprietary feature. It is available only for IKEv2, and is used to determine whether to merge network segments when a single encryption stream includes multiple local/peer addresses. By default, security parameter index (SPI) merging is enabled.

Expiration Time

This is a proprietary feature, which is used to specify the validity period of a tunnel. By default, this feature is disabled. We recommend that you keep it disabled.

Configuration Item (Fortinet)

Description

Template type: site-to-site, hub-and-spoke, and remote access

- This is a proprietary feature. We recommend that you customize settings as needed.

- The site-to-site and remote access types are available only for Fortinet and Cisco.

- The hub-and-spoke type is available only for Fortinet.

Forward Error Correction

- This is a proprietary feature, which is disabled by default. Fortinet incorporates forward error correction (FEC) into its IPsec VPN service to enhance data transmission reliability and efficiency. FEC can detect and correct data errors during data transmission, and therefore reduces the data loss and retransmission rate.

- We recommend that you disable it. Otherwise, IPsec VPN tunnel establishment may be affected.

Device creation

Aggregate member

- These are proprietary features, which are disabled by default. Ignore them.

- We recommend that you disable them. Otherwise, IPsec VPN tunnel establishment may be affected.

XAUTH

- Athena NGFW does not support this feature. This is an additional step for identity authentication during the IPsec VPN tunnel establishment, which can enhance security. It is supported only for IKEv1. By default, it is disabled in Fortinet.

- We recommend that you disable it. Otherwise, IPsec VPN tunnel establishment may be affected.

Selector

- This is equivalent to an encrypted traffic entry in Athena NGFW in policy mode. We recommend that you configure a single selector using an all-0 address.

- This is equivalent to the traffic of interest in Athena NGFW in route mode. If IPv4 is enabled in Athena NGFW, it is equivalent to a Fortinet selector using an all-0 IPv4 address. If IPV6 is enabled in Athena NGFW, it is equivalent to a Fortinet selector using an all-0 IPv6 address.

Local Address: IP address ranges, IPv6 address ranges, named addresses, and IPv6 named addresses

Remote Address: IP address ranges, IPv6 address ranges, named addresses, and IPv6 named addresses

- These are proprietary features. By contrast, Athena NGFW supports only subnets, IPv6 subnets, IP addresses, and IPv6 addresses.

- We recommend that you do not use IP address ranges, because Athena NGFW does not support IP address ranges. Otherwise, IPsec VPN tunnel establishment may fail.

- When a named address (address group) is used in policy mode, we recommend that you use IKEv2. Otherwise, IPsec VPN tunnel establishment may fail in phase 2.

Diffie-Hellman Group: group31 and group32

Athena NGFW does not support these DH groups. Use other DH groups as needed, which do not affect IPsec VPN tunnel establishment.

Encryption: CHACHA20POLY1305

Athena NGFW does not support this encryption algorithm. Use other algorithms as needed, which do not affect IPsec VPN tunnel establishment.

Enable Replay Detection

- Athena NGFW does not support customizing reply detection settings, and disables replay detection by default.

- By default, replay detection is enabled in Fortinet. If the peer end has two Fortinet firewalls deployed in active/standby mode, disable this feature. Otherwise, business may be interrupted during an active/standby switchover.

Local Port

Remote Port

Protocol

- These are proprietary features, which are used to configure the phase-2 local port, peer port, and protocol. By default, all local and remote ports and all protocols are selected.

- We recommend that you select all local and remote ports and all protocols. Otherwise, IPsec VPN tunnel establishment may be affected.

Other

Use the default settings, which do not affect IPsec VPN tunnel establishment.