NETWORK TOPOLOGY

Fortigate ADVPN - BGP

Jose Silva
Network Topology

Table of Contents
1 Introduction .......................................................................................................................................... 2
2 Network Diagram .................................................................................................................................. 2
3 Platform and images ............................................................................................................................. 3
4 IP address space .................................................................................................................................... 3
5 Network Equipment Configuration ....................................................................................................... 3
5.1 “Internet” router ........................................................................................................................... 3
5.2 Datacenter ISP1 router ................................................................................................................. 5
5.3 Datacenter ISP2 router ................................................................................................................. 6
5.4 Datacenter distribution switch ..................................................................................................... 7
5.5 Datacenter firewall ....................................................................................................................... 9
5.6 Copenhagen distribution switch ................................................................................................. 17
5.7 Copenhagen aggregation switch................................................................................................. 18
5.8 Setubal ISP1 router ..................................................................................................................... 20
5.9 Setubal ISP2 router ..................................................................................................................... 21
5.10 Setubal distribution switch ......................................................................................................... 22
5.11 Setubal firewall ........................................................................................................................... 23
5.12 Paris ISP1 router.......................................................................................................................... 31
5.13 Paris ISP2 router.......................................................................................................................... 32
5.14 Paris distribution switch.............................................................................................................. 33
5.15 Paris firewall................................................................................................................................ 34

Fortigate ADVPN - BGP |1

Network Topology

1 Introduction
This network laboratory tests the connectivity between branch office and a datacenter
using ADVPN on FortiGate firewalls. Also, the connectivity provided to the internet from
services on a DMZ network on the datacenter. All branch sites and the datacenter are provided
with two ISPs for internet access fault tolerance. All accesses to the internet are implemented
through FortiGate’s SD-WAN rules. The branches have configured two ADVPN connection to
each of the ISPs on the datacenter, and the access on these ones are also implemented using
SD-WAN rules.
All routing is done using BGP over the VPN connections between the branches and the
datacenter.

2 Network Diagram

Fortigate ADVPN - BGP |2

Network Topology

3 Platform and images

This lab was implemented using GNS3 and the table below specifies the images used for
each type of equipment.
All images were downloaded from the official sites respectively. They are only trial
licenses, and all restrictions apply.

Device Image
Internet Cisco IOU router v15.5.2T
dc-fw01 Fortigate 64b VM v7.0.2 build 0234
stb-fw01 Fortigate 64b VM v7.0.2 build 0234
cph-fw01 Fortigate 64b VM v7.0.2 build 0234
dc-sw90 Cisco IOU switch v15.2d
stb-sw90 Cisco IOU switch v15.2d
cph-sw90 Cisco IOU switch v15.2d
dc-sw00 Cisco IOU switch v15.2d
stb-sw00 Cisco IOU switch v15.2d
cph-sw00 Cisco IOU switch v15.2d

4 IP address space
The following table represents the IP address space used on the branches and on the
datacenter.

Datacenter 10.2.0.0./16
Copenhagen 10.8.0.0/16
Setubal 10.4.0.0/16
Paris 10.6.0.0/16
ADVPN 10.255.250.0/24

5 Network Equipment Configuration

5.1 “Internet” router
! ######################################################
! ## Internet
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname internet
ip domain name inet.com
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!

Fortigate ADVPN - BGP |3

Network Topology

! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Ethernet0/0
description = dc-isp1
ip address 192.168.2.1 255.255.255.252
no shutdown
exit
!
interface Ethernet0/1
description = dc-isp2
ip address 192.168.2.5 255.255.255.252
no shutdown
exit
!
interface Ethernet0/2
description = stb-isp1
ip address 192.168.4.1 255.255.255.252
no shutdown
exit
!
interface Ethernet0/3
description = stb-isp2
ip address 192.168.4.5 255.255.255.252
no shutdown
exit
!
interface Ethernet1/0
description = par-isp1
ip address 192.168.6.1 255.255.255.252
no shutdown
exit
!
interface Ethernet1/1
description = par-isp2
ip address 192.168.6.5 255.255.255.252
no shutdown
exit
!
interface Ethernet1/2
description = web-clients
ip address 192.168.255.1 255.255.255.0
no shutdown
exit
!
interface Ethernet1/3
description = web-servers
ip address 192.168.250.1 255.255.255.0
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------

Fortigate ADVPN - BGP |4

Network Topology

ip route 0.0.0.0 0.0.0.0 Null0

!
router bgp 65000
bgp log-neighbor-changes
neighbor 192.168.2.2 remote-as 65022
neighbor 192.168.2.6 remote-as 65026
neighbor 192.168.4.2 remote-as 65042
neighbor 192.168.4.6 remote-as 65046
neighbor 192.168.6.2 remote-as 65062
neighbor 192.168.6.6 remote-as 65066
!
address-family ipv4
network 0.0.0.0
neighbor 192.168.2.2 activate
neighbor 192.168.2.2 next-hop-self
neighbor 192.168.2.6 activate
neighbor 192.168.2.6 next-hop-self
neighbor 192.168.4.2 activate
neighbor 192.168.4.2 next-hop-self
neighbor 192.168.4.6 activate
neighbor 192.168.4.6 next-hop-self
neighbor 192.168.6.2 activate
neighbor 192.168.6.2 next-hop-self
neighbor 192.168.6.6 activate
neighbor 192.168.6.6 next-hop-self
exit-address-family
exit
!

5.2 Datacenter ISP1 router

! ######################################################
! ## DC ISP01
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname dc-isp-01
ip domain name dc01.com
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Ethernet0/0
description = internet
ip address 192.168.2.2 255.255.255.252
no shutdown
exit
!
interface Ethernet0/1
shutdown

Fortigate ADVPN - BGP |5

Network Topology

exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = acme-dc
ip address 192.168.20.1 255.255.255.252
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip route 0.0.0.0 0.0.0.0 192.168.2.1
ip route 192.168.100.0 255.255.255.224 192.168.20.2
!
router bgp 65022
bgp log-neighbor-changes
neighbor 192.168.2.1 remote-as 65000
!
address-family ipv4
network 0.0.0.0
network 192.168.20.0 mask 255.255.255.252
network 192.168.100.0 mask 255.255.255.224
neighbor 192.168.2.1 activate
neighbor 192.168.2.1 next-hop-self
exit-address-family
exit
!

5.3 Datacenter ISP2 router

! ######################################################
! ## DC ISP02
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname dc-isp-02
ip domain name dc02.com
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Ethernet0/0
description = internet
ip address 192.168.2.6 255.255.255.252
no shutdown

Fortigate ADVPN - BGP |6

Network Topology

exit
!
interface Ethernet0/1
shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = acme-dc
ip address 192.168.20.5 255.255.255.252
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip route 0.0.0.0 0.0.0.0 192.168.2.5
!
router bgp 65026
bgp log-neighbor-changes
neighbor 192.168.2.5 remote-as 65000
!
address-family ipv4
network 0.0.0.0
network 192.168.20.4 mask 255.255.255.252
neighbor 192.168.2.5 activate
neighbor 192.168.2.5 next-hop-self
exit-address-family
exit
!

5.4 Datacenter distribution switch

! ######################################################
! ## DC distribution switch
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname dc-sw-00
ip domain name acme.local
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- VTP and VLANs
! ----------------------------------------
vtp domain AcmeDCNet
vtp password AcmeDCNetPass
vtp pruning

Fortigate ADVPN - BGP |7

Network Topology

vtp version 3
vtp mode server
do vtp primary force
!
vlan 5
name Management
exit
!
vlan 10
name Servers
exit
!
vlan 3172
name Dmz
exit
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Vlan5
description = management
ip address 10.2.5.10 255.255.255.0
no shutdown
exit
!
interface Ethernet0/0
description = server
switchport
switchport mode access
switchport access vlan 10
spanning-tree portfast
no shutdown
exit
!
interface Ethernet0/1
description = dmz
switchport
switchport mode access
switchport access vlan 3172
spanning-tree portfast
no shutdown
exit
!
interface Ethernet0/2
description = dc-fw-01-port4
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 5,10,3172
no shutdown
exit
!
interface Ethernet0/3
shutdown
exit

Fortigate ADVPN - BGP |8

Network Topology

!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip default-gateway 10.2.5.1
!

5.5 Datacenter firewall

! ######################################################
! ## DC firewall
! ######################################################
! -- Global configuration
! ----------------------------------------
config system global
set alias "dc-fw-01"
set hostname "dc-fw-01"
set timezone 28
end
!
! ----------------------------------------
! -- DNS
! ----------------------------------------
config system dns
set primary 10.2.10.50
set domain "acme.local"
end
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
config system interface
edit "port1"
set vdom "root"
set mode static
set ip 192.168.20.2 255.255.255.252
set allowaccess ping
set type physical
set alias "isp01"
next
edit "port2"
set vdom "root"
set mode static
set ip 192.168.20.6 255.255.255.252
set allowaccess ping
set type physical
set alias "isp02"
next
edit "port4"
set vdom "root"
set type physical
set alias "dkdc"
set lldp-reception enable
set lldp-transmission enable

Fortigate ADVPN - BGP |9

Network Topology

next
edit "dc-netmgmt"
set vdom "root"
set ip 10.2.5.1 255.255.255.0
set allowaccess ping http
set vlanforward enable
set device-identification enable
set role lan
set interface "port4"
set vlanid 5
next
edit "dc-servers"
set vdom "root"
set ip 10.2.10.1 255.255.255.0
set allowaccess ping
set vlanforward enable
set device-identification enable
set role lan
set interface "port4"
set vlanid 10
next
edit "dc-dmz"
set vdom "root"
set ip 172.16.2.1 255.255.255.224
set allowaccess ping
set vlanforward enable
set device-identification enable
set role lan
set interface "port4"
set vlanid 3172
next
edit "port7"
set vdom "root"
set type physical
set alias "cph"
set lldp-reception enable
set lldp-transmission enable
next
edit "cph-netmgmt"
set vdom "root"
set ip 10.8.5.1 255.255.255.0
set allowaccess ping
set vlanforward enable
set device-identification enable
set role lan
set interface "port7"
set vlanid 5
next
edit "cph-office"
set vdom "root"
set dhcp-relay-service enable
set ip 10.8.16.1 255.255.255.0
set allowaccess ping
set vlanforward enable

Fortigate ADVPN - BGP | 10

Network Topology

set device-identification enable

set role lan
set dhcp-relay-ip "10.2.10.50"
set interface "port7"
set vlanid 16
next
end
!
! ----------------------------------------
! -- Static routing
! ----------------------------------------
config router static
edit 1
set dst 192.168.1.0 255.255.255.0
set gateway 192.168.106.2
set device "port8"
next
edit 2
set dst 10.2.0.0 255.255.0.0
set blackhole enable
next
edit 3
set dst 10.8.0.0 255.255.0.0
set blackhole enable
next
edit 4
set gateway 192.168.20.1
set device "port1"
next
edit 5
set gateway 192.168.20.5
set device "port2"
set distance 15
next
end
!
! ----------------------------------------
! -- Objects addresses
! ----------------------------------------
config firewall address
edit "net-dkdc"
set subnet 10.2.0.0/16
next
edit "net-cphsite"
set subnet 10.8.0.0/16
next
edit "net-stbsite"
set subnet 10.4.0.0/16
next
edit "net-parsite"
set subnet 10.6.0.0/16
next
edit "net-dkdc-netmgmt"
set subnet 10.2.5.0/24

Fortigate ADVPN - BGP | 11

Network Topology

next
edit "net-dkdc-servers"
set subnet 10.2.10.0/24
next
edit "net-dkdc-dmz"
set subnet 172.16.2.0/24
next
edit "net-cph-netmgmt"
set subnet 10.8.5.0 255.255.255.0
next
edit "net-cph-office"
set subnet 10.8.16.0 255.255.255.0
next
edit "net-stb-netmgmt"
set subnet 10.4.5.0 255.255.255.0
next
edit "net-stb-office"
set subnet 10.4.16.0 255.255.255.0
next
edit "net-par-netmgmt"
set subnet 10.6.5.0 255.255.255.0
next
edit "net-par-office"
set subnet 10.6.16.0 255.255.255.0
next
edit "net-10.0.0.0m8"
set subnet 10.0.0.0 255.0.0.0
next
end
!
! ----------------------------------------
! -- SD-WAN
! ----------------------------------------
config system sdwan
set status enable
config zone
edit "sdwan-internet"
next
end
config members
edit 1
set interface "port1"
set zone "sdwan-internet"
set gateway 192.168.20.1
next
edit 2
set interface "port2"
set zone "sdwan-internet"
set gateway 192.168.20.5
next
end
config health-check
edit "sla_internet"
set server "192.168.250.1"

Fortigate ADVPN - BGP | 12

Network Topology

set members 1 2
next
end
config service
edit 1
set name "rule-internet"
set mode priority
set dst "all"
set src "all"
set health-check "sla_internet"
set priority-members 1 2
set priority-zone "sdwan-internet"
next
end
end
!
! ----------------------------------------
! -- Firewall virtual IPs
! ----------------------------------------
config firewall vip
edit "dkdc-dmz-public-nat"
set extip 192.168.100.10-192.168.100.30
set mappedip "172.16.2.10-172.16.2.30"
set extintf "any"
next
end
!
! ----------------------------------------
! -- Firewall zones
! ----------------------------------------
config system zone
edit "dkdc"
set intrazone allow
set interface "dc-netmgmt" "dc-servers" "dc-dmz"
next
edit "cphsite"
set intrazone allow
set interface "cph-netmgmt" "cph-office"
next
end
!
! ----------------------------------------
! -- Firewall policies
! ----------------------------------------
config firewall policy
edit 1
set name "cphsite-internet-access"
set srcintf "cphsite"
set dstintf "internet-sdwan"
set action accept
set srcaddr "net-cphsite"
set dstaddr "all"
set schedule "always"
set service "ALL_ICMP" "HTTP"

Fortigate ADVPN - BGP | 13

Network Topology

set logtraffic all

set nat enable
next
edit 2
set name "internet-to-dkdc-dmz"
set srcintf "internet-sdwan"
set dstintf "dkdc"
set action accept
set srcaddr "all"
set dstaddr "dkdc-dmz-public-nat"
set schedule "always"
set service "HTTP"
set logtraffic all
next
end
!
! ----------------------------------------
! -- ADVPN-HUB
! ----------------------------------------
config vpn ipsec phase1-interface
edit "AcmeVPN1"
set type dynamic
set interface "port1"
set peertype any
set net-device disable
set add-route disable
set ike-version 2
set proposal des-sha256
set auto-discovery-sender enable
set dpd on-idle
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
next
edit "AcmeVPN2"
set type dynamic
set interface "port2"
set peertype any
set net-device disable
set add-route disable
set ike-version 2
set proposal des-sha256
set auto-discovery-sender enable
set dpd on-idle
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
next
end
config vpn ipsec phase2-interface
edit "AcmeVPN1"
set phase1name "AcmeVPN1"
set proposal des-sha256
next
edit "AcmeVPN2"
set phase1name "AcmeVPN2"

Fortigate ADVPN - BGP | 14

Network Topology

set proposal des-sha256

next
end
! ----------------------------------------
! -- ADVPN interfaces
! ----------------------------------------
config system interface
edit "AcmeVPN1"
set ip 10.255.250.1/32
set allowaccess ping
set remote-ip 10.255.250.254/24
next
edit "AcmeVPN2"
set ip 10.255.250.2/32
set allowaccess ping
set remote-ip 10.255.250.254/24
next
end
!
! ----------------------------------------
! -- Firewall zones
! ----------------------------------------
config system zone
edit "acmevpn"
set intrazone allow
set interface "AcmeVPN1" "AcmeVPN2"
next
end
!
! ----------------------------------------
! -- Firewall policies
! ----------------------------------------
config firewall policy
edit 3
set name "dkdc-to-acmevpn"
set srcintf "dkdc"
set dstintf "acmevpn"
set action accept
set srcaddr "net-dkdc"
set dstaddr "net-10.0.0.0m8"
set schedule "always"
set service "ALL_ICMP"
set logtraffic all
next
edit 4
set name "cphsite-to-acmevpn"
set srcintf "cphsite"
set dstintf "acmevpn"
set action accept
set srcaddr "net-cphsite"
set dstaddr "net-10.0.0.0m8"
set schedule "always"
set service "ALL_ICMP"
set logtraffic all

Fortigate ADVPN - BGP | 15

Network Topology

next
edit 5
set name "acmevpn-to-dkdc"
set srcintf "acmevpn"
set dstintf "dkdc"
set action accept
set srcaddr "net-10.0.0.0m8"
set dstaddr "net-dkdc"
set schedule "always"
set service "ALL_ICMP"
set logtraffic all
next
edit 6
set name "acmevpn-to-cphsite"
set srcintf "acmevpn"
set dstintf "cphsite"
set action accept
set srcaddr "net-10.0.0.0m8"
set dstaddr "net-cphsite"
set schedule "always"
set service "ALL_ICMP"
set logtraffic all
next
edit 7
set name "acmevpn-to-acmevpn"
set srcintf "acmevpn"
set dstintf "acmevpn"
set action accept
set srcaddr "net-10.0.0.0m8"
set dstaddr "net-10.0.0.0m8"
set schedule "always"
set service "ALL"
set logtraffic all
next
end
!
! ----------------------------------------
! -- Routing - BGP
! ----------------------------------------
config system interface
edit "Loopback0"
set vdom "root"
set type loopback
set ip 10.255.255.2/32
set allowaccess ping
next
end
!
config router bgp
set as 65000
set router-id 10.255.255.2
config neighbor-group
edit "AcmeSites"
set remote-as 65000

Fortigate ADVPN - BGP | 16

Network Topology

set link-down-failover enable

set route-reflector-client enable
next
end
config neighbor-range
edit 1
set prefix 10.255.250.0/24
set neighbor-group "AcmeSites"
next
end
config network
edit 1
set prefix 10.255.255.2/32
next
edit 2
set prefix 10.2.0.0/16
next
edit 3
set prefix 10.8.0.0/16
next
end
end
!

5.6 Copenhagen distribution switch

! ######################################################
! ## CPH distribution switch
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname dc-cph-00
ip domain name acme.local
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- VTP and VLANs
! ----------------------------------------
vtp domain AcmeCPHNet
vtp password AcmeCPHNetPass
vtp pruning
vtp version 3
vtp mode server
do vtp primary force
!
vlan 5
name Management
exit
!
vlan 16
name Office

Fortigate ADVPN - BGP | 17

Network Topology

exit
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Vlan5
description = management
ip address 10.8.5.10 255.255.255.0
no shutdown
exit
!
interface Ethernet0/0
description = Po10
channel-group 10 mode active
no shutdown
exit
!
interface Ethernet0/1
description = Po10
channel-group 10 mode active
no shutdown
exit
!
interface Ethernet0/2
description = dc-fw-01-port7
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 5,16
no shutdown
exit
!
interface Ethernet0/3
shutdown
exit
!
interface Port-channel10
description = cph-sw-00
switchport trunk encapsulation dot1q
switchport mode trunk
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip default-gateway 10.8.5.1
!

5.7 Copenhagen aggregation switch

! ######################################################
! ## CPH aggregation switch
! ######################################################
! -- Global configuration
! ----------------------------------------

Fortigate ADVPN - BGP | 18

Network Topology

hostname cph-sw-00
ip domain name acme.local
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- VTP and VLANs
! ----------------------------------------
vtp domain AcmeCPHNet
vtp password AcmeCPHNetPass
vtp pruning
vtp version 3
vtp mode client
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Vlan5
description = management
ip address 10.8.5.11 255.255.255.0
no shutdown
exit
!
interface Ethernet0/0
description = Po10
channel-group 10 mode active
no shutdown
exit
!
interface Ethernet0/1
description = Po10
channel-group 10 mode active
no shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = clientpc
switchport mode access
switchport access vlan 16
spanning-tree portfast edge
no shutdown
exit
!
interface Port-channel10
description = dc-cph-00
switchport trunk encapsulation dot1q
switchport mode trunk
no shutdown

Fortigate ADVPN - BGP | 19

Network Topology

exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip default-gateway 10.8.5.1
!

5.8 Setubal ISP1 router

! ######################################################
! ## STB ISP01
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname stb-isp-01
ip domain name stb01.com
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Ethernet0/0
description = internet
ip address 192.168.4.2 255.255.255.252
no shutdown
exit
!
interface Ethernet0/1
shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = acme-stb
ip address 192.168.40.1 255.255.255.252
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip route 0.0.0.0 0.0.0.0 192.168.4.1
!
router bgp 65042
bgp log-neighbor-changes
neighbor 192.168.4.1 remote-as 65000
!

Fortigate ADVPN - BGP | 20

Network Topology

address-family ipv4
network 0.0.0.0
network 192.168.40.0 mask 255.255.255.252
neighbor 192.168.4.1 activate
neighbor 192.168.4.1 next-hop-self
exit-address-family
exit
!

5.9 Setubal ISP2 router

! ######################################################
! ## STB ISP02
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname stb-isp-02
ip domain name stb02.com
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Ethernet0/0
description = internet
ip address 192.168.4.6 255.255.255.252
no shutdown
exit
!
interface Ethernet0/1
shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = acme-stb
ip address 192.168.40.5 255.255.255.252
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip route 0.0.0.0 0.0.0.0 192.168.4.5
!
router bgp 65046
bgp log-neighbor-changes
neighbor 192.168.4.5 remote-as 65000

Fortigate ADVPN - BGP | 21

Network Topology

!
address-family ipv4
network 0.0.0.0
network 192.168.40.4 mask 255.255.255.252
neighbor 192.168.4.5 activate
neighbor 192.168.4.5 next-hop-self
exit-address-family
exit
!

5.10 Setubal distribution switch

! ######################################################
! ## STB distribution switch
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname stb-sw-00
ip domain name acme.local
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- VTP and VLANs
! ----------------------------------------
vtp domain AcmeSTBNet
vtp password AcmeSTBNetPass
vtp pruning
vtp version 3
vtp mode server
do vtp primary force
!
vlan 5
name Management
exit
!
vlan 16
name Office
exit
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Vlan5
description = management
ip address 10.4.5.10 255.255.255.0
no shutdown
exit
!
interface Ethernet0/0
description = stb-fw-01-port7
switchport trunk encapsulation dot1q

Fortigate ADVPN - BGP | 22

Network Topology

switchport mode trunk

switchport trunk allowed vlan 5,16
no shutdown
exit
!
interface Ethernet0/1
shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = clientpc
switchport mode access
switchport access vlan 16
spanning-tree portfast edge
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip default-gateway 10.4.5.1
!

5.11 Setubal firewall

! ######################################################
! ## STB firewall
! ######################################################
! -- Global configuration
! ----------------------------------------
config system global
set alias "stb-fw-01"
set hostname "stb-fw-01"
set timezone 28
end
!
! ----------------------------------------
! -- DNS
! ----------------------------------------
config system dns
set primary 10.2.10.50
set domain "acme.local"
end
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
config system interface
edit "port1"
set vdom "root"

Fortigate ADVPN - BGP | 23

Network Topology

set mode static

set ip 192.168.40.2 255.255.255.252
set allowaccess ping
set type physical
set alias "isp01"
next
edit "port2"
set vdom "root"
set mode static
set ip 192.168.40.6 255.255.255.252
set allowaccess ping
set type physical
set alias "isp02"
next
edit "port7"
set vdom "root"
set type physical
set alias "stb"
set lldp-reception enable
set lldp-transmission enable
next
edit "stb-netmgmt"
set vdom "root"
set ip 10.4.5.1 255.255.255.0
set allowaccess ping http
set vlanforward enable
set device-identification enable
set role lan
set interface "port7"
set vlanid 5
next
edit "stb-office"
set vdom "root"
set dhcp-relay-service enable
set ip 10.4.16.1 255.255.255.0
set allowaccess ping
set vlanforward enable
set device-identification enable
set role lan
set dhcp-relay-ip "10.2.10.50"
set interface "port7"
set vlanid 16
next
end
!
! ----------------------------------------
! -- Static routing
! ----------------------------------------
config router static
edit 1
set dst 192.168.1.0 255.255.255.0
set gateway 192.168.106.2
set device "port8"
next

Fortigate ADVPN - BGP | 24

Network Topology

edit 2
set dst 10.4.0.0 255.255.0.0
set blackhole enable
next
edit 3
set gateway 192.168.40.1
set device "port1"
next
edit 4
set gateway 192.168.40.5
set device "port2"
set distance 15
next
end
!
! ----------------------------------------
! -- Objects addresses
! ----------------------------------------
config firewall address
edit "net-dkdc"
set subnet 10.2.0.0/16
next
edit "net-cphsite"
set subnet 10.8.0.0/16
next
edit "net-stbsite"
set subnet 10.4.0.0/16
next
edit "net-parsite"
set subnet 10.6.0.0/16
next
edit "net-dkdc-netmgmt"
set subnet 10.2.5.0/24
next
edit "net-dkdc-servers"
set subnet 10.2.10.0/24
next
edit "net-dkdc-dmz"
set subnet 172.16.2.0/24
next
edit "net-cph-netmgmt"
set subnet 10.8.5.0 255.255.255.0
next
edit "net-cph-office"
set subnet 10.8.16.0 255.255.255.0
next
edit "net-stb-netmgmt"
set subnet 10.4.5.0 255.255.255.0
next
edit "net-stb-office"
set subnet 10.4.16.0 255.255.255.0
next
edit "net-par-netmgmt"
set subnet 10.6.5.0 255.255.255.0

Fortigate ADVPN - BGP | 25

Network Topology

next
edit "net-par-office"
set subnet 10.6.16.0 255.255.255.0
next
edit "net-10.0.0.0m8"
set subnet 10.0.0.0 255.0.0.0
next
end
!
! ----------------------------------------
! -- ADVPN-SPOKE
! ----------------------------------------
config vpn ipsec phase1-interface
edit "AcmeVPN11"
set interface "port1"
set peertype any
set net-device disable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.2
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
next
edit "AcmeVPN21"
set interface "port2"
set peertype any
set net-device disable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.2
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
set monitor "AcmeVPN11"
next
edit "AcmeVPN12"
set interface "port1"
set peertype any
set net-device enable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.6
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
next
edit "AcmeVPN22"

Fortigate ADVPN - BGP | 26

Network Topology

set interface "port2"

set peertype any
set net-device enable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.6
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
set monitor "AcmeVPN12"
next
end
config vpn ipsec phase2-interface
edit "AcmeVPN11"
set phase1name "AcmeVPN11"
set proposal des-sha256
set auto-negotiate enable
next
edit "AcmeVPN21"
set phase1name "AcmeVPN21"
set proposal des-sha256
set auto-negotiate enable
next
edit "AcmeVPN12"
set phase1name "AcmeVPN12"
set proposal des-sha256
set auto-negotiate enable
next
edit "AcmeVPN22"
set phase1name "AcmeVPN22"
set proposal des-sha256
set auto-negotiate enable
next
end
!
! ----------------------------------------
! -- ADVPN interfaces
! ----------------------------------------
config system interface
edit "AcmeVPN11"
set ip 10.255.250.4/32
set allowaccess ping
set remote-ip 10.255.250.1/24
next
edit "AcmeVPN21"
set ip 10.255.250.204/32
set allowaccess ping
set remote-ip 10.255.250.1/24
next
edit "AcmeVPN12"
set ip 10.255.250.5/32
set allowaccess ping

Fortigate ADVPN - BGP | 27

Network Topology

set remote-ip 10.255.250.2/24

next
edit "AcmeVPN22"
set ip 10.255.250.205/32
set allowaccess ping
set remote-ip 10.255.250.2/24
next
end
!
! ----------------------------------------
! -- Firewall zones
! ----------------------------------------
config system zone
edit "stbsite"
set intrazone allow
set interface "stb-netmgmt" "stb-office"
next
end
!
! ----------------------------------------
! -- SD-WAN
! ----------------------------------------
config system sdwan
set status enable
config zone
edit "sdwan-acmevpn"
next
edit "sdwan-internet"
next
end
config members
edit 1
set interface "port1"
set zone "sdwan-internet"
set gateway 192.168.40.1
next
edit 2
set interface "port2"
set zone "sdwan-internet"
set gateway 192.168.40.5
next
edit 3
set interface "AcmeVPN11"
set zone "sdwan-acmevpn"
set gateway 10.255.250.1
next
edit 4
set interface "AcmeVPN21"
set zone "sdwan-acmevpn"
set gateway 10.255.250.1
next
edit 5
set interface "AcmeVPN12"
set zone "sdwan-acmevpn"

Fortigate ADVPN - BGP | 28

Network Topology

set gateway 10.255.250.2

next
edit 6
set interface "AcmeVPN22"
set zone "sdwan-acmevpn"
set gateway 10.255.250.2
next
end
config health-check
edit "sla_internet"
set server "192.168.250.1"
set members 1 2
next
edit "sla_acmevpn"
set server "10.2.10.1"
set members 3 4 5 6
next
end
config service
edit 1
set name "rule-acmevpn"
set mode priority
set dst "net-10.0.0.0m8"
set src "net-10.0.0.0m8"
set health-check "sla_acmevpn"
set priority-members 3 4 5 6
next
edit 2
set name "rule-internet"
set mode priority
set dst "all"
set src "net-stbsite"
set health-check "sla_internet"
set priority-members 1 2
next
end
end
!
! ----------------------------------------
! -- Firewall policies
! ----------------------------------------
config firewall policy
edit 1
set name "stbsite-internet-access"
set srcintf "stbsite"
set dstintf "sdwan-internet"
set action accept
set srcaddr "net-stbsite"
set dstaddr "all"
set schedule "always"
set service "ALL_ICMP" "HTTP"
set logtraffic all
set nat enable
next

Fortigate ADVPN - BGP | 29

Network Topology

edit 2
set name "stbsite-to-acmevpn"
set srcintf "stbsite"
set dstintf "sdwan-acmevpn"
set action accept
set srcaddr "net-stbsite"
set dstaddr "net-10.0.0.0m8"
set schedule "always"
set service "ALL"
set logtraffic all
next
edit 3
set name "acmevpn-to-stbsite"
set srcintf "sdwan-acmevpn"
set dstintf "stbsite"
set action accept
set srcaddr "net-10.0.0.0m8"
set dstaddr "net-stbsite"
set schedule "always"
set service "ALL"
set logtraffic all
next
end
!
! ----------------------------------------
! -- Routing - BGP
! ----------------------------------------
config system interface
edit "Loopback0"
set vdom "root"
set type loopback
set ip 10.255.255.4/32
set allowaccess ping
next
end
!
config router bgp
set as 65000
set router-id 10.255.255.4
config neighbor
edit "10.255.250.1"
set remote-as 65000
set advertisement-interval 1
set link-down-failover enable
next
edit "10.255.250.2"
set remote-as 65000
set advertisement-interval 1
set link-down-failover enable
next
end
config network
edit 1
set prefix 10.4.0.0/16

Fortigate ADVPN - BGP | 30

Network Topology

next
edit 2
set prefix 10.255.255.4/32
next
end
end
!

5.12 Paris ISP1 router

! ######################################################
! ## PAR ISP01
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname par-isp-01
ip domain name par01.com
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Ethernet0/0
description = internet
ip address 192.168.6.2 255.255.255.252
no shutdown
exit
!
interface Ethernet0/1
shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = acme-par
ip address 192.168.60.1 255.255.255.252
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip route 0.0.0.0 0.0.0.0 192.168.6.1
!
router bgp 65062
bgp log-neighbor-changes
neighbor 192.168.6.1 remote-as 65000
!

Fortigate ADVPN - BGP | 31

Network Topology

address-family ipv4
network 0.0.0.0
network 192.168.60.0 mask 255.255.255.252
neighbor 192.168.6.1 activate
neighbor 192.168.6.1 next-hop-self
exit-address-family
exit
!

5.13 Paris ISP2 router

! ######################################################
! ## PAR ISP02
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname par-isp-02
ip domain name par02.com
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Ethernet0/0
description = internet
ip address 192.168.6.6 255.255.255.252
no shutdown
exit
!
interface Ethernet0/1
shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = acme-stb
ip address 192.168.60.5 255.255.255.252
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip route 0.0.0.0 0.0.0.0 192.168.6.5
!
router bgp 65066
bgp log-neighbor-changes
neighbor 192.168.6.5 remote-as 65000

Fortigate ADVPN - BGP | 32

Network Topology

!
address-family ipv4
network 0.0.0.0
network 192.168.60.4 mask 255.255.255.252
neighbor 192.168.6.5 activate
neighbor 192.168.6.5 next-hop-self
exit-address-family
exit
!

5.14 Paris distribution switch

! ######################################################
! ## PAR distribution switch
! ######################################################
! -- Global configuration
! ----------------------------------------
hostname par-sw-00
ip domain name acme.local
no ip domain lookup
no logg console
logg buffered 131072 debug
service password-encryption
!
! ----------------------------------------
! -- VTP and VLANs
! ----------------------------------------
vtp domain AcmePARNet
vtp password AcmePARNetPass
vtp pruning
vtp version 3
vtp mode server
do vtp primary force
!
vlan 5
name Management
exit
!
vlan 16
name Office
exit
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
interface Vlan5
description = management
ip address 10.6.5.10 255.255.255.0
no shutdown
exit
!
interface Ethernet0/0
description = par-fw-01-port7
switchport trunk encapsulation dot1q

Fortigate ADVPN - BGP | 33

Network Topology

switchport mode trunk

switchport trunk allowed vlan 5,16
no shutdown
exit
!
interface Ethernet0/1
shutdown
exit
!
interface Ethernet0/2
shutdown
exit
!
interface Ethernet0/3
description = clientpc
switchport mode access
switchport access vlan 16
spanning-tree portfast edge
no shutdown
exit
!
! ----------------------------------------
! -- Routing
! ----------------------------------------
ip default-gateway 10.6.5.1
!

5.15 Paris firewall

! ######################################################
! ## PAR firewall
! ######################################################
! -- Global configuration
! ----------------------------------------
config system global
set alias "par-fw-01"
set hostname "par-fw-01"
set timezone 28
end
!
! ----------------------------------------
! -- DNS
! ----------------------------------------
config system dns
set primary 10.2.10.50
set domain "acme.local"
end
!
! ----------------------------------------
! -- Interfaces
! ----------------------------------------
config system interface
edit "port1"
set vdom "root"

Fortigate ADVPN - BGP | 34

Network Topology

set mode static

set ip 192.168.60.2 255.255.255.252
set allowaccess ping
set type physical
set alias "isp01"
next
edit "port2"
set vdom "root"
set mode static
set ip 192.168.60.6 255.255.255.252
set allowaccess ping
set type physical
set alias "isp02"
next
edit "port7"
set vdom "root"
set type physical
set alias "par"
set lldp-reception enable
set lldp-transmission enable
next
edit "par-netmgmt"
set vdom "root"
set ip 10.6.5.1 255.255.255.0
set allowaccess ping http
set vlanforward enable
set device-identification enable
set role lan
set interface "port7"
set vlanid 5
next
edit "par-office"
set vdom "root"
set dhcp-relay-service enable
set ip 10.6.16.1 255.255.255.0
set allowaccess ping
set vlanforward enable
set device-identification enable
set role lan
set dhcp-relay-ip "10.2.10.50"
set interface "port7"
set vlanid 16
next
end
!
! ----------------------------------------
! -- Static routing
! ----------------------------------------
config router static
edit 1
set dst 192.168.1.0 255.255.255.0
set gateway 192.168.106.2
set device "port8"
next

Fortigate ADVPN - BGP | 35

Network Topology

edit 2
set dst 10.6.0.0 255.255.0.0
set blackhole enable
next
edit 3
set gateway 192.168.60.1
set device "port1"
next
edit 4
set gateway 192.168.60.5
set device "port2"
set distance 15
next
end
!
! ----------------------------------------
! -- Objects addresses
! ----------------------------------------
config firewall address
edit "net-dkdc"
set subnet 10.2.0.0/16
next
edit "net-cphsite"
set subnet 10.8.0.0/16
next
edit "net-stbsite"
set subnet 10.4.0.0/16
next
edit "net-parsite"
set subnet 10.6.0.0/16
next
edit "net-dkdc-netmgmt"
set subnet 10.2.5.0/24
next
edit "net-dkdc-servers"
set subnet 10.2.10.0/24
next
edit "net-dkdc-dmz"
set subnet 172.16.2.0/24
next
edit "net-cph-netmgmt"
set subnet 10.8.5.0 255.255.255.0
next
edit "net-cph-office"
set subnet 10.8.16.0 255.255.255.0
next
edit "net-stb-netmgmt"
set subnet 10.4.5.0 255.255.255.0
next
edit "net-stb-office"
set subnet 10.4.16.0 255.255.255.0
next
edit "net-par-netmgmt"
set subnet 10.6.5.0 255.255.255.0

Fortigate ADVPN - BGP | 36

Network Topology

next
edit "net-par-office"
set subnet 10.6.16.0 255.255.255.0
next
edit "net-10.0.0.0m8"
set subnet 10.0.0.0 255.0.0.0
next
end
!
! ----------------------------------------
! -- ADVPN-SPOKE
! ----------------------------------------
config vpn ipsec phase1-interface
edit "AcmeVPN11"
set interface "port1"
set peertype any
set net-device disable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.2
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
next
edit "AcmeVPN21"
set interface "port2"
set peertype any
set net-device disable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.2
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
set monitor "AcmeVPN11"
next
edit "AcmeVPN12"
set interface "port1"
set peertype any
set net-device enable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.6
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
next
edit "AcmeVPN22"

Fortigate ADVPN - BGP | 37

Network Topology

set interface "port2"

set peertype any
set net-device enable
set auto-discovery-receiver enable
set add-route disable
set ike-version 2
set proposal des-sha256
set dpd on-idle
set remote-gw 192.168.20.6
set psksecret AcmeADVPNTunnel
set dpd-retryinterval 5
set monitor "AcmeVPN12"
next
end
config vpn ipsec phase2-interface
edit "AcmeVPN11"
set phase1name "AcmeVPN11"
set proposal des-sha256
set auto-negotiate enable
next
edit "AcmeVPN21"
set phase1name "AcmeVPN21"
set proposal des-sha256
set auto-negotiate enable
next
edit "AcmeVPN12"
set phase1name "AcmeVPN12"
set proposal des-sha256
set auto-negotiate enable
next
edit "AcmeVPN22"
set phase1name "AcmeVPN22"
set proposal des-sha256
set auto-negotiate enable
next
end
!
! ----------------------------------------
! -- ADVPN interfaces
! ----------------------------------------
config system interface
edit "AcmeVPN11"
set ip 10.255.250.6/32
set allowaccess ping
set remote-ip 10.255.250.1/24
next
edit "AcmeVPN21"
set ip 10.255.250.206/32
set allowaccess ping
set remote-ip 10.255.250.1/24
next
edit "AcmeVPN12"
set ip 10.255.250.7/32
set allowaccess ping

Fortigate ADVPN - BGP | 38

Network Topology

set remote-ip 10.255.250.2/24

next
edit "AcmeVPN22"
set ip 10.255.250.207/32
set allowaccess ping
set remote-ip 10.255.250.2/24
next
end
!
! ----------------------------------------
! -- Firewall zones
! ----------------------------------------
config system zone
edit "parsite"
set intrazone allow
set interface "par-netmgmt" "par-office"
next
end
!
! ----------------------------------------
! -- SD-WAN
! ----------------------------------------
config system sdwan
set status enable
config zone
edit "sdwan-acmevpn"
next
edit "sdwan-internet"
next
end
config members
edit 1
set interface "port1"
set zone "sdwan-internet"
set gateway 192.168.60.1
next
edit 2
set interface "port2"
set zone "sdwan-internet"
set gateway 192.168.60.5
next
edit 3
set interface "AcmeVPN11"
set zone "sdwan-acmevpn"
next
edit 4
set interface "AcmeVPN21"
set zone "sdwan-acmevpn"
next
edit 5
set interface "AcmeVPN12"
set zone "sdwan-acmevpn"
next
edit 6

Fortigate ADVPN - BGP | 39

Network Topology

set interface "AcmeVPN22"

set zone "sdwan-acmevpn"
next
end
config health-check
edit "sla_internet"
set server "192.168.250.1"
set members 1 2
next
edit "sla_acmevpn"
set server "10.2.10.1"
set members 3 4 5 6
next
end
config service
edit 1
set name "rule-acmevpn"
set mode priority
set src "net-10.0.0.0m8"
set dst "net-10.0.0.0m8"
set health-check "sla_acmevpn"
set priority-members 3 4 5 6
next
edit 2
set name "rule-internet"
set mode priority
set dst "all"
set src "net-stbsite"
set health-check "sla_internet"
set priority-members 1 2
next
end
end
!
! ----------------------------------------
! -- Firewall policies
! ----------------------------------------
config firewall policy
edit 1
set name "parsite-internet-access"
set srcintf "parsite"
set dstintf "sdwan-internet"
set action accept
set srcaddr "net-parsite"
set dstaddr "all"
set schedule "always"
set service "ALL_ICMP" "HTTP"
set logtraffic all
set nat enable
next
edit 2
set name "parsite-to-acmevpn"
set srcintf "parsite"
set dstintf "sdwan-acmevpn"

Fortigate ADVPN - BGP | 40

Network Topology

set action accept

set srcaddr "net-parsite"
set dstaddr "net-10.0.0.0m8"
set schedule "always"
set service "ALL"
set logtraffic all
next
edit 3
set name "acmevpn-to-parsite"
set srcintf "sdwan-acmevpn"
set dstintf "parsite"
set action accept
set srcaddr "net-10.0.0.0m8"
set dstaddr "net-parsite"
set schedule "always"
set service "ALL"
set logtraffic all
next
end
!
! ----------------------------------------
! -- Routing - BGP
! ----------------------------------------
config system interface
edit "Loopback0"
set vdom "root"
set type loopback
set ip 10.255.255.6/32
set allowaccess ping
next
end
!
config router bgp
set as 65000
set router-id 10.255.255.6
config neighbor
edit "10.255.250.1"
set remote-as 65000
set advertisement-interval 1
set link-down-failover enable
next
edit "10.255.250.2"
set remote-as 65000
set advertisement-interval 1
set link-down-failover enable
next
end
config network
edit 1
set prefix 10.6.0.0/16
next
edit 2
set prefix 10.255.255.6/32
next

Fortigate ADVPN - BGP | 41

Network Topology

end
end
!

Fortigate ADVPN - BGP | 42