{"id":11473,"date":"2021-10-31T17:39:09","date_gmt":"2021-10-31T09:39:09","guid":{"rendered":"https:\/\/ailog.tw\/lifelog\/?p=11473"},"modified":"2021-11-25T12:16:07","modified_gmt":"2021-11-25T04:16:07","slug":"fortigate-vxlan","status":"publish","type":"post","link":"https:\/\/ailog.tw\/lifelog\/2021\/10\/31\/fortigate-vxlan\/","title":{"rendered":"\u900f\u904eFortigate VPN\u5efa\u7acbVXLAN\u8b93\u5206\u9694\u7570\u5730\u7684\u5169\u7aef\u4f7f\u7528\u76f8\u540c\u7684\u5340\u57df\u7db2\u8def"},"content":{"rendered":"

\u4eba\u751f\u771f\u7684\u662f\u5145\u6eff\u4e86\u6311\u6230\uff0c\u5c0f\u7de8\u6700\u8fd1\u8655\u7406\u4e86\u4e00\u500b\u900f\u904eFortigate\u5efa\u7acbVXLAN\u8b93\u5206\u9694\u5169\u5730\u7684\u7db2\u8def\u53ef\u4ee5\u4e32\u9023\u5728\u4e00\u8d77\uff0c\u4e26\u4e14\u5f62\u6210\u540c\u4e00\u500b\u5167\u90e8\u7db2\u8def\uff0c\u6548\u679c\u5c31\u8ddf\u9ede\u5c0d\u9ede(point to point network)L2\u5c08\u7dda\u4e00\u6a23\uff0c\u96d6\u7136\u53cd\u61c9\u901f\u5ea6\u7565\u905c\u5c08\u7dda\uff0c\u4f46\u50f9\u683c\u5dee\u8ddd\u53ef\u662f\u76f8\u7576\u9a5a\u4eba\uff0c\u56e0\u6b64\u5c31\u53ef\u4ee5\u4e86\u89e3\u70ba\u4f55\u6703\u6709\u4f01\u696d\u60f3\u9019\u6a23\u505a\u4e86\u5427!<\/span><\/p>\n

\u4e00\u3001\u60c5\u5883\u8aaa\u660e<\/span>
\n(1)\u3001IDC\u53caDR\u5169\u7aef\u5404\u6709\u4e00\u53f0Fortigate\u9632\u706b\u7246\uff0c\u8a2d\u5099\u97cc\u9ad4\u5747\u63a1\u75286.4.4(1803)\uff0c\u5e0c\u671b\u900f\u904eVPN VXLAN\u6280\u8853\uff0c\u8b93\u5206\u9694\u5169\u7aef\u7684\u7db2\u8def\u5f62\u6210\u4e00\u500b\u865b\u64ec\u7684L2\u5167\u7db2\u3002<\/span><\/p>\n

(2)\u3001\u60c5\u5883\u67b6\u69cb\u5716\uff1a
\n\"\"
\n<\/span><\/p>\n

(3)\u3001\u672c\u7bc4\u4f8b\u8a2d\u5b9a\u904e\u7a0b\u5747\u63a1\u7528Conosle\u6a21\u5f0f
\n(4)\u3001VXLAN\u8a72\u529f\u80fd\u53ea\u652f\u63f4FortOS 5.4\u7248\u672c\u4ee5\u4e0a\uff0c\u4f465.6\u4ee5\u4e0a\u529f\u80fd\u8f03\u70ba\u5b8c\u5584\u3002
\n(5)\u3001\u8a72\u529f\u80fd\u662f\u900f\u904eIPSec VPN\u67b6\u69cb\u9032\u884c\uff0c\u4f46\u7121\u6cd5\u900f\u904e\u52a0\u901f\u6676\u7247\u9032\u884c\u52a0\u901f\uff0c\u56e0\u6b64\u5982\u679c\u6d41\u91cf\u904e\u5927\uff0c\u8acb\u6ce8\u610f\u8a2d\u5099\u7b49\u7d1a\u53ca\u6548\u80fd\u3002
\n(6)\u3001\u672c\u7bc4\u4f8b\u9632\u706b\u7246\u76f8\u95dc\u8cc7\u8a0a
\nWan interface\uff1awan1
\nLan interface\uff1ainternal1
\nIDC\u9632\u706b\u7246Wan\u7aef\u771f\u5be6IP\uff1a192.192.205.1
\nDR\u9632\u706b\u7246Wan\u7aef\u771f\u5be6IP\uff1a192.192.209.1
\nVPN psksecret\uff1a0800080080<\/span><\/span><\/p>\n


\n<\/span>\u4e8c\u3001\u8a2d\u5b9a\u6b65\u9a5f
\n(1)\u3001IDC\u7aef\u7684Fortigate\u8a2d\u5b9aWAN\u7aefIP\u53ca\u9810\u8a2d\u9598\u9053
\n\u6307\u4ee4\uff1a<\/span>
\nconfig system interface<\/span>
\nedit “wan1”<\/span>
\nset vdom “root”<\/span>
\nset ip 192.192.205.1 255.255.255.0<\/span><\/span>
\nset allowaccess ping<\/span>
\nset type physical<\/span>
\nset role wan<\/span>
\nset snmp-index 1<\/span>
\nnext
\nend<\/span><\/p>\n

config router static<\/span>
\nedit 1<\/span>
\nset gateway 192.192.205.254<\/span><\/span>
\nset device “wan1”<\/span>
\nnext<\/span>
\nend<\/span><\/p>\n

(2)\u3001DR\u7aef\u7684Fortigate\u8a2d\u5b9aWAN\u7aefIP\u53ca\u9810\u8a2d\u9598\u9053
\n\u6307\u4ee4\uff1a
\nconfig system interface
\nedit “wan1”
\nset vdom “root”
\nset ip 192.192.209.1 255.255.255.0<\/span>
\nset allowaccess ping
\nset type physical
\nset role wan
\nset snmp-index 1
\nnext
\nend<\/span><\/p>\n

config router static<\/span>
\nedit 1<\/span>
\nset gateway 192.192.209.254<\/span><\/span>
\nset device “wan1”<\/span>
\nnext<\/span>
\nend<\/span><\/p>\n

(3)\u3001IDC\u7aef\u7684Fortigate\u5efa\u7acbVXLAN VPN
\n\u6307\u4ee4\uff1a
\nconfig vpn ipsec phase1-interface<\/span>
\nedit VXLAN<\/span>
\nset interface wan1<\/span>
\nset peertype any<\/span>
\nset proposal aes256-sha1<\/span>
\nset encapsulation vxlan<\/span>
\nset encapsulation-address ipv4<\/span>
\nset encap-local-gw4 192.192.205.1<\/span><\/span>
\nset encap-remote-gw4 192.192.209.1<\/span><\/span>
\nset remote-gw 192.192.209.1<\/span><\/span>
\nset psksecret 0800080080<\/span><\/span>
\nnext<\/span>
\nend<\/span><\/p>\n

config vpn ipsec phase2-interface<\/span>
\nedit VXLAN_ph2<\/span>
\nset phase1name VXLAN<\/span>
\nset proposal aes256-sha1<\/span>
\nset auto-negotiate enable<\/span>
\nnext<\/span>
\nend<\/span><\/p>\n

(4)\u3001DR\u7aef\u7684Fortigate\u5efa\u7acbVXLAN VPN
\n\u6307\u4ee4\uff1a
\nconfig vpn ipsec phase1-interface<\/span>
\nedit VXLAN<\/span>
\nset interface wan1<\/span>
\nset peertype any<\/span>
\nset proposal aes256-sha1<\/span>
\nset encapsulation vxlan<\/span>
\nset encapsulation-address ipv4<\/span>
\nset encap-local-gw4 192.192.209.1<\/span><\/span>
\nset encap-remote-gw4 192.192.205.1<\/span><\/span>
\nset remote-gw 192.192.205.1<\/span><\/span>
\nset psksecret 0800080080<\/span><\/span>
\nnext<\/span>
\nend<\/span><\/p>\n

config vpn ipsec phase2-interface<\/span>
\nedit VXLAN_ph2<\/span>
\nset phase1name VXLAN<\/span>
\nset proposal aes256-sha1<\/span>
\nset auto-negotiate enable<\/span>
\nnext<\/span>
\nend<\/span><\/p>\n

(5)\u3001\u5728IDC\u53caDR\u5169\u7aef\u7684Fortigate\u8a2d\u5b9aVPN\u4ecb\u9762\u63a1\u7528L2\u50b3\u905e\u6a21\u5f0f
\n\u6307\u4ee4\uff1a
\nconfig system interface
\nedit VXLAN
\nset l2forward enable
\nset mtu-override enable<\/span><\/span>
\nnext
\nend
\n<\/span><\/p>\n

(6)\u3001\u5728IDC\u53caDR\u5169\u7aef\u7684Fortigate\u5efa\u7acb\u865b\u64ecSwitch
\n\u6307\u4ee4\uff1a
\nconfig system switch-interface
\nedit VXLAN-SWITCH
\nset vdom root
\nset member internal1 VXLAN<\/span>
\nnext
\nend
\n\"\"
\n\u5099\u8a3b\u8aaa\u660e\uff1a\u5efa\u7acb\u5b8c\u7562\u865b\u64ecSWITCH\u5f8c\u7684\u7db2\u9801\u756b\u9762<\/span><\/p>\n

(7)\u3001\u5728IDC\u53caDR\u5169\u7aef\u7684Fortigate\u8a2d\u5b9a
\nconfig system global
\nset honor-df disable<\/span>
\nend
\n\u5099\u8a3b\u8aaa\u660e\uff1a
\nFortiOS does not send back an ICMP \u201cdestination unreachable, fragmentation needed and DF set\u201d to the source when an IP packet with the DF bit set and a size greater than the tunnel MTU cannot be forwarded inside the VxLAN-IPsec tunne<\/span>
\n<\/span><\/p>\n

\u4e09\u3001\u5be6\u6e2c
\n(1)\u3001\u5728IDC\u7aefFortigate\u9632\u706b\u7246\u7684internal1\u63a5\u4e0a\u4e00\u53f0\u96fb\u8166\uff0c\u4e26\u628aIP\u8a2d\u5b9a\u70ba192.168.100.1<\/span>\/24\u3002<\/span><\/span><\/span><\/p>\n

(2)\u3001\u5728DR\u7aefFortigate\u9632\u706b\u7246\u7684internal1<\/span>\u63a5\u4e0a\u4e00\u53f0\u96fb\u8166\uff0c\u4e26\u628aIP\u8a2d\u5b9a\u70ba192.168.100.2<\/span>\/24\u3002<\/span><\/p>\n

(3)\u3001\u900f\u904e\u9019\u5169\u53f0\u96fb\u8166\u9032\u884cIP\u4e92ping\u7684\u52d5\u4f5c(\u8a18\u5f97\u95dc\u9589\u96fb\u8166\u4e0a\u7684\u9632\u706b\u7246\u9650\u5236)\uff0c\u5982\u679c\u53ef\u4ee5\u901a\u90a3\u5c31\u5b8c\u6210\u6240\u6709\u8a2d\u5b9a\u4e86\u3002<\/span><\/span><\/span><\/p>\n

\u56db\u3001\u8f14\u52a9\u8aaa\u660e<\/span>
\n\u8a2d\u5b9a\u904e\u7a0b\u4e2d\u9700\u8981\u8a2d\u5b9a
\nset l2forward enable<\/span>
\n\u53ca<\/span>
\nset honor-df disable
\n<\/span>\u7684\u53c3\u8003\u8aaa\u660e\uff1a
\nhttps:\/\/community.fortinet.com\/t5\/FortiGate\/Technical-Tip-Global-setting-honor-df-explained\/ta-p\/197002?externalID=FD51964<\/a><\/span>
\n<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u4eba\u751f\u771f\u7684\u662f\u5145\u6eff\u4e86\u6311\u6230\uff0c\u5c0f\u7de8\u6700\u8fd1\u8655\u7406\u4e86\u4e00\u500b\u900f\u904eFortigate\u5efa\u7acbVXLAN\u8b93\u5206\u9694\u5169\u5730\u7684\u7db2\u8def\u53ef\u4ee5\u4e32\u9023\u5728\u4e00\u8d77\uff0c\u4e26 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u900f\u904eFortigate VPN\u5efa\u7acbVXLAN\u8b93\u5206\u9694\u7570\u5730\u7684\u5169\u7aef\u4f7f\u7528\u76f8\u540c\u7684\u5340\u57df\u7db2\u8def\u3009<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":11479,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,381],"tags":[41,4953,92,4950,4952,4951],"class_list":["post-11473","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-itinfo","category-firewall","tag-fortigate","tag-l2","tag-vpn","tag-vxlan","tag-4952","tag-4951"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/posts\/11473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/comments?post=11473"}],"version-history":[{"count":12,"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/posts\/11473\/revisions"}],"predecessor-version":[{"id":11844,"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/posts\/11473\/revisions\/11844"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/media\/11479"}],"wp:attachment":[{"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/media?parent=11473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/categories?post=11473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ailog.tw\/lifelog\/wp-json\/wp\/v2\/tags?post=11473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}