Configuring a CloudBridge Connector tunnel between a Citrix ADC appliance and fortinet fortiGate appliance
You can configure a CloudBridge Connector tunnel between a Citrix ADC appliance and a Fortinet FortiGate appliance to connect two datacenters or extend your network to a cloud provider. The Citrix ADC appliance and the FortiGate appliance form the end points of the CloudBridge Connector tunnel and are called peers.
Example of a CloudBridge Connector Tunnel Configuration
As an illustration of the traffic flow in a CloudBridge Connector tunnel, consider an example in which a CloudBridge Connector tunnel is set up between the following devices:
- Citrix ADC appliance NS_Appliance-1 in a datacenter designated as Datacenter-1
- FortiGate appliance FortiGate-Appliance-1 in a datacenter designated as Datacenter-2
NS_Appliance-1 and FortiGate-Appliance-1 enable communication between private networks in Datacenter-1 and Datacenter-2 through the CloudBridge Connector tunnel. In the example, NS_Appliance-1 and FortiGate-Appliance-1 enable communication between client CL1 in Datacenter-1 and server S1 in Datacenter-2 through the CloudBridge Connector tunnel. Client CL1 and server S1 are on different private networks.
On NS_Appliance-1, the CloudBridge Connector tunnel configuration includes IPSec profile entity NS_Fortinet_IPSec_Profile, CloudBridge Connector tunnel entity NS_Fortinet_Tunnel, and policy based routing (PBR) entity NS_Fortinet_Pbr.
For more information, seeCloudBridge Connector tunnel configuration tablepdf.
For information about Settings on Fortinet FortiGate-Appliance-1 in Datacenter-2, seetable.
Points to consider for a CloudBridge Connector tunnel configuration
Before configuring a CloudBridge Connector tunnel between a Citrix ADC appliance and a FortiGate appliance, consider the following points:
The following IPSec settings are supported for a CloudBridge Connector tunnel between a Citrix ADC appliance and a FortiGate appliance.
IPSec Properties Settings IPSec mode Tunnel mode IKE version Version 1 IKE DH group DH group 2 (1024 bits MODP algorithm) IKE authentication method Pre-Shared Key IKE encryption algorithm AES IKE hash algorithm HMAC SHA1 ESP encryption algorithm AES ESP hash algorithm HMAC SHA1 - You must specify the same IPSec settings on the Citrix ADC appliance and the FortiGate appliance at the two ends of the CloudBridge Connector.
- Citrix ADC provides a common parameter (in IPSec profiles) for specifying an IKE hash algorithm and an ESP hash algorithm. It also provides another common parameter for specifying an IKE encryption algorithm and an ESP encryption algorithm. Therefore in the FortiGate appliance, you must specify the same hash algorithm and same encryption algorithm in IKE (phase 1 configuration) and ESP (phase 2 configuration).
- You must configure the firewall at the Citrix ADC end and FortiGate end to allow the following.
- Any UDP packets for port 500
- Any UDP packets for port 4500
- Any ESP (IP protocol number 50) packets
- FortiGate appliance supports two types of VPN tunnels: Policy-based and Route-based. Only policy-based VPN tunnel is supported between a FortiGate appliance and a Citrix ADC appliance.
Configuring FortiGate appliance for the CloudBridge Connector tunnel
配置一个CloudBridge连接器隧道FortiGate appliance, use the Fortinet Web-based Manager, which is the primary user interface for configuring, monitoring, and maintaining FortiGate appliances.
Before you begin the CloudBridge Connector tunnel configuration on a FortiGate appliance, make sure that:
- You have a user account with administrator credentials on the FortiGate appliance.
- You are familiar with the Fortinet Web-based Manager.
- The FortiGate appliance is UP and running, is connected to the Internet, and is also connected to the private subnets whose traffic is to be protected over the CloudBridge Connector tunnel.
Note
The procedures for configuring CloudBridge Connector tunnel on a FortiGate appliance might change over time, depending on the Fortinet release cycle. Citrix recommends that you follow the official Fortinet product documentation forConfiguring IPSec VPN tunnels.
To configure a CloudBridge connector tunnel between a Citrix ADC appliance and a FortiGate appliance, perform the following tasks on the FortiGate appliance by using the Fortinet Web-based manager:
- Enable Policy-based IPSec VPN feature. Enable this feature for creating policy-based VPN tunnels on the FortiGate appliance. Only policy-based type of VPN tunnel is supported between a FortiGate appliance and a Citrix ADC appliance. A policy-based VPN tunnel configuration on a FortiGate appliance includes phase 1 settings, phase 2 settings, and an IPSec security policy.
- Define phase 1 parameters.阶段1 FortiGate应用所使用的参数ance for IKE Authentication before forming a secure tunnel to the Citrix ADC appliance.
- 定义阶段2参数. Phase 2 parameters are used by the FortiGate appliance for forming a secure tunnel to the Citrix ADC appliance by establishing IKE security associations (SA).
- 指定私人年代ubnets. Define the FortiGate-side and the Citrix ADC-side private subnets whose IP traffic is to be transported through the tunnel.
- Define an IPSec security policy for the tunnel. A security policy allow IP traffic to pass between interfaces on a FortiGate appliance. An IPSec security policy specifies the interface to the private subnet and the interface connecting the Citrix ADC appliance through the tunnel.
To enable Policy-based IPSec VPN feature by using the Fortinet Web-based Manager
- Navigate toSystem>Config>Features.
- On theFeature Settingspage, selectShow Moreand turn onPolicy-based IPSec VPN.
To define phase 1 parameters by using the Fortinet Web-based Manager
- Navigate toVPN>IPsec>Auto Key (IKE)and clickCreate Phase1.
- On theNew Phase 1page, set the following parameters:
- Name: Enter a name for this phase 1 configuration.
- Remote Gateway: SelectStatic IP Address.
- Mode: SelectMain (ID Protection).
- Authentication Method: SelectPreshared Key.
- Pre-Shared Key: Enter a pre-shared key. The same pre-shared key must be configured on the Citrix ADC appliance.
- Peer Options: Set the following IKE paramters for authenticating a Citrix ADC appliance.
- IKE Version: Select1.
- Mode Config: Clear this option if it is selected.
- Local Gateway IP: SelectMain Interface IP.
- P1 Proposal: Select the encryption and authentication algorithms for IKE Authentication before forming a secure tunnel to the Citrix ADC appliance.
- 1 - Encryption: SelectAES128.
- Authentication: SelectSHA1.
- Keylife: Enter an amount of time (in seconds) for the phase 1 key life.
- DH Group: Select 2.
- X-Auth: SelectDisable.
- Deed Peer Detection: Select this option.
- ClickOK.
To specify private subnets by using the Fortinet Web-based Manager
- Navigate toFirewall Objects>Address>Addressesand selectCreate New.
- On theNew Addresspage, set the following parameters:
- Name: Enter a name for FortiGate-side subnet.
- Type: SelectSubnet.
- Subnet / IP Range: Enter the address of the FortiGate-side subnet.
- Interface: Select the local interface to this subnet.
- ClickOK.
- Repeat steps 1-3 to specify the Citrix ADC-side subnet.
To define phase 2 parameters by using the Fortinet Web-based Manager
- Navigate toVPN>IPsec>Auto Key (IKE)and clickCreate Phase 2.
- On theNew Phase 2page, set the following parameters:
- Name: Enter a name for this phase 2 configuration.
- Phase 1: Select the Phase 1 configuration from the drop-down list.
- ClickAdvancedand set the following parameters:
- P2 Proposal: Select the encryption and authentication algorithms for forming a secure tunnel to the Citrix ADC appliance.
- 1 - Encryption: SelectAES128.
- Authentication: SelectSHA1.
- Enable replay detection: Select this option.
- Enable perfect forward secrecy (PFS): Select this option.
- DH Group: Select2.
- Keylife: Enter an amount of time (in seconds) for the phase 2 key life.
- Autokey Keep Alive: Select this option.
- Auto-negotiate: Select this option.
- Quick Mode Selector: Specify the FortiGate-side and the Citrix ADC-side private subnets whose traffic is to be traversed through the tunnel.
- Source Address: Select the FortiGate-side subnet from the drop-down list.
- Source Port: Enter0.
- Destination Address: Select the Citrix ADC-side subnet from the drop-down list.
- Destination Port: Enter0.
- Protocol: Enter0.
- P2 Proposal: Select the encryption and authentication algorithms for forming a secure tunnel to the Citrix ADC appliance.
- ClickOK.
To define an IPSec security policy by using the Fortinet Web-based Manager
- Navigate toPolicy>Policy>Policyand clickCreate New.
- On theEdit Policypage, set the following parameters:
- Policy Type: SelectVPN.
- Policy Subtype: SelectIPSec.
- Local Interface: Select the local interface to the internal (private) network.
- Local Protected Subnet: Select the FortiGate-side subnet from the drop-down list whose traffic is to be traversed through the tunnel.
- Outgoing VPN Interface: Select the local interface to the external (public) network.
- Remote Protected Subnet: Select the Citrix ADC-side subnet from the drop-down list whose traffic is to be traversed through the tunnel.
- Schedule: Keep the default setting (always) unless changes are needed to meet specific requirements.
- Service: Keep the default setting (ANY) unless changes are needed to meet your specific requirements.
- VPN Tunnel: SelectUse Existingand select the tunnel from the drop-down list.
- Allow traffic to be initiated from the remote site: Select if traffic from the remote network will be allowed to initiate the tunnel.
- ClickOK.
Configuring the Citrix ADC appliance for the CloudBridge Connector tunnel
To configure a CloudBridge Connector tunnel between a Citrix ADC appliance and a FortiGate appliance, perform the following tasks on the Citrix ADC appliance. You can use either the Citrix ADC command line or the Citrix ADC graphical user interface (GUI):
- Create an IPSec profile. An IPSec profile entity specifies the IPSec protocol parameters, such as IKE version, encryption algorithm, hash algorithm, and authentication method to be used by the IPSec protocol in the CloudBridge Connector tunnel.
- Create an IP tunnel that uses IPSec protocol, and associate the IPSec profile with it. An IP tunnel specifies the local IP address (CloudBridge Connector tunnel end point IP address (of type SNIP) configured on the Citrix ADC appliance), remote IP address (CloudBridge Connector tunnel endpoint IP address configured on the FortiGate appliance), protocol (IPSec) used to set up the CloudBridge Connector tunnel, and an IPSec profile entity. The created IP tunnel entity is also called the CloudBridge Connector tunnel entity.
- Create a PBR rule and associate it with the IP tunnel. A PBR entity specifies a set of rules and an IP tunnel (CloudBridge Connector tunnel) entity. The source IP address range and the destination IP address range are the conditions for the PBR entity. Set the source IP address range to specify the Citrix ADC-side subnet whose traffic is to be protected over the tunnel, and set the destination IP address range to specify the FortiGate appliance side subnet whose traffic is to be protected over the tunnel.
To create an IPSEC profile by using the Citrix ADC command line
At the command prompt, type:
add ipsec profile
--psk -ikeVersion v1 encAlgo AES -hashAlgo HMAC_SHA1 -perfectForwardSecrecy ENABLE
show ipsec profile
To create an IPSEC tunnel and bind the IPSEC profile to it by using the Citrix ADC command line
At the command prompt, type:
add ipTunnel
-protocol IPSEC –ipsecProfileName** show ipTunnel
To create a PBR rule and bind the IPSEC tunnel to it by using the Citrix ADC command line
At the command prompt, type:
add pbr
ALLOW –srcIP -destIP -ipTunnel apply pbrs
show pbr
To create an IPSEC profile by using the GUI
- Navigate toSystem>CloudBridge Connector>IPSec Profile.
- In the details pane, clickAdd.
- In theAdd IPSec Profilepage, set the following parameters:
- Name
- Encryption Algorithm
- Hash Algorithm
- IKE协议版本
- Perfect Forward Secrecy (Enable this paramter)
- Configure the IPSec authentication method to be used by the two CloudBridge Connector tunnel peers to mutually authenticate: Select the Pre-shared key authentication method and set the Pre-Shared Key Exists parameter.
- ClickCreate, and then clickClose.
To create an IP tunnel and bind the IPSEC profile to it by using the GUI
- Navigate toSystem>CloudBridge Connector>IP Tunnels.
- On theIPv4 Tunnelstab, clickAdd.
- In theAdd IP Tunnelpage, set the following parameters:
- Name
- Remote IP
- Remote Mask
- Local IP Type (In the Local IP Type drop-down list, selectSubnet IP).
- Local IP (All the configured IP addresses of the selected IP type are in the Local IP drop down list. Select the desired IP from the list.)
- Protocol
- IPSec Profile
- ClickCreate, and then clickClose.
To create a PBR rule and bind the IPSEC tunnel to it by using the GUI
- Navigate toSystem>Network>PBR.
- On thePBRtab, clickAdd.
- In theCreate PBRpage, set the following parameters:
- Name
- Action
- Next Hop Type (SelectIP Tunnel)
- IP Tunnel Name
- Source IP Low
- Source IP High
- Destination IP Low
- Destination IP High
- ClickCreate, and then clickClose.
The corresponding new CloudBridge Connector tunnel configuration on the Citrix ADC appliance appears in the GUI.
The current status of the CloudBridge connector tunnel is shown in the Configured CloudBridge Connector pane. A green dot indicates that the tunnel is up. A red dot indicates that the tunnel is down.
The following commands create settings of Citrix ADC appliance NS_Appliance-1 in “Example of a CloudBridge Connector Configuration.”
> add ipsec profile NS_Fortinet_IPSec_Profile -psk examplepresharedkey -ikeVersion v1 –encAlgo AES –hashalgo HMAC_SHA1 –lifetime 315360 -perfectForwardSecrecy ENABLE Done > add iptunnel NS_Fortinet_Tunnel 203.0.113.200 255.255.255.255 198.51.100.100 –protocol IPSEC –ipsecProfileName NS_Fortinet_IPSec_Profile Done > add pbr NS_Fortinet_Pbr -srcIP 10.102.147.0-10.102.147.255 –destIP 10.20.0.0-10.20.255.255 –ipTunnel NS_Fortinet_Tunnel Done > apply pbrs Done
Monitoring the CloudBridge Connector tunnel
You can monitor the performance of CloudBridge Connector tunnels on a Citrix ADC appliance by using CloudBridge Connector tunnel statistical counters. For more information about displaying CloudBridge Connector tunnel statistics on a Citrix ADC appliance, seeMonitoring CloudBridge Connector Tunnels.
In this article
- Example of a CloudBridge Connector Tunnel Configuration
- Points to consider for a CloudBridge Connector tunnel configuration
- Configuring FortiGate appliance for the CloudBridge Connector tunnel
- Configuring the Citrix ADC appliance for the CloudBridge Connector tunnel
- Monitoring the CloudBridge Connector tunnel