IPsec VPN Between Cisco and FortiGate: Interoperable Configuration

April 15, 2026·2 min read·298 words

Interoperable Cisco ↔ FortiGate IPsec VPN: IKEv2 configuration with matching proposals. Pay close attention to details such as the DH group, lifetime and PFS. Step-by-step guide with troubleshooting. A common use case in multi-vendor enterprise environments.

Common IKEv2 Parameters for 2026

Encryption: AES-256-GCM (recommended)
Integrity: SHA-384
DH Group: 19 (ECP-256) or 20 (ECP-384)
PFS: DH 19
Lifetime: 28800s (8h) for phase 1, 3600s for phase 2
Mode: tunnel

Cisco IOS-XE Side

crypto ikev2 proposal PROP-IOS
encryption aes-gcm-256
integrity sha384
group 19
crypto ikev2 policy POL-IOS
proposal PROP-IOS
crypto ikev2 keyring KEY-FG
peer FORTIGATE
address 203.0.113.2
pre-shared-key SharedKey123
crypto ikev2 profile PROF-FG
match identity remote address 203.0.113.2 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local KEY-FG
crypto ipsec transform-set TS esp-gcm 256
mode tunnel
crypto ipsec profile IPSEC-PROF
set transform-set TS
set pfs group19
set ikev2-profile PROF-FG
interface Tunnel 0
ip address 172.16.0.1 255.255.255.252
tunnel source GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel destination 203.0.113.2
tunnel protection ipsec profile IPSEC-PROF

FortiGate Side

config vpn ipsec phase1-interface
edit "VPN-CISCO"
set interface "port10"
set ike-version 2
set peertype any
set remote-gw 203.0.113.1
set psksecret SharedKey123
set proposal aes256gcm-sha384
set dhgrp 19
next
config vpn ipsec phase2-interface
edit "VPN-CISCO-P2"
set phase1name "VPN-CISCO"
set proposal aes256gcm-sha384
set dhgrp 19
set src-subnet 192.168.1.0 255.255.255.0
set dst-subnet 10.0.0.0 255.255.255.0
next

Troubleshooting

Cisco: show crypto ikev2 sa (phase 1)
Cisco: show crypto ipsec sa (phase 2)
debug crypto ikev2 error
FortiGate: diagnose vpn ike gateway list
FortiGate: diagnose vpn tunnel list
Check: ping through the tunnel

Common Issues

Proposal mismatch: check encryption + integrity + DH on both sides
Mismatched PSK
NAT-T: enable on both sides
Intermediate firewall blocking UDP 500/4500
Proxy IDs (traffic selectors) do not match

Order from OPTINOC

Multi-vendor IPsec VPN configuration: Cisco, FortiGate, Palo Alto, Juniper and Stormshield. Diagnosis within 2 hours.