Setting up a site-to-site VPN on a FortiGate

A site-to-site VPN comes up only when both ends agree on their security settings, so filling a gap in the request with a guess gives you a tunnel that looks configured and carries nothing. 2501 configures the FortiGate end from your ticket and reports anything missing rather than inventing it, all within limits you set.

Beyond the remote address and the networks on each side, a tunnel needs security settings that match the far end exactly, a route, policies that let the traffic through and a shared key the ticket often leaves out. One wrong or missing piece leaves it down, or up with the traffic blocked.

What 2501 does

The FortiOS specialty takes the request from your ticketing system and checks what already exists on the FortiGate against the ticket. It reuses objects rather than duplicating them, follows your naming conventions, and goes back to the requester when what is there contradicts the ticket. It configures this end of the tunnel, with the route and policies the traffic needs, and verifies each change once made. Without the shared key, it configures everything else and leaves the key for your team to enter. It reports what it found and what it changed.

You stay in control

• You choose the level: investigate only, act after a person confirms, or act on its own within your rules. The level is set per specialty, not per ticket.
• Nothing is guessed: a missing address, network or setting goes back to the requester rather than being filled in.
• Existing policies stay as they are: they change only when a ticket explicitly asks, and a duplicate is reported to the requester rather than created.
• Your rules apply: which FortiGates it may change unattended and which changes need a person first, and blacklisted commands stay out of reach.

Frequently asked

Why is the tunnel up but no traffic passes? Traffic also needs a route and a policy on each side, and both ends must agree on which networks they exchange.

Can it check an existing tunnel instead? Yes. It investigates tunnels that are down, and in investigate-only mode it reports what it found and changes nothing.

Related

• FortiOS Manager
• Adding a security rule on a Palo Alto firewall
• Guardrails: what an agent may never touch