IPsec VPN Between Cisco and FortiGate: Interoperable Configuration
·2 min read·298 words
Interoperable Cisco ↔ FortiGate IPsec VPN: IKEv2 configuration with matching proposals. Pay close attention to details such as the DH group, lifetime and PFS. Step-by-step guide with troubleshooting. A common use case in multi-vendor enterprise environments.
Common IKEv2 Parameters for 2026
- Encryption: AES-256-GCM (recommended)
- Integrity: SHA-384
- DH Group: 19 (ECP-256) or 20 (ECP-384)
- PFS: DH 19
- Lifetime: 28800s (8h) for phase 1, 3600s for phase 2
- Mode: tunnel
Cisco IOS-XE Side
- crypto ikev2 proposal PROP-IOS
- encryption aes-gcm-256
- integrity sha384
- group 19
- crypto ikev2 policy POL-IOS
- proposal PROP-IOS
- crypto ikev2 keyring KEY-FG
- peer FORTIGATE
- address 203.0.113.2
- pre-shared-key SharedKey123
- crypto ikev2 profile PROF-FG
- match identity remote address 203.0.113.2 255.255.255.255
- authentication remote pre-share
- authentication local pre-share
- keyring local KEY-FG
- crypto ipsec transform-set TS esp-gcm 256
- mode tunnel
- crypto ipsec profile IPSEC-PROF
- set transform-set TS
- set pfs group19
- set ikev2-profile PROF-FG
- interface Tunnel 0
- ip address 172.16.0.1 255.255.255.252
- tunnel source GigabitEthernet0/0
- tunnel mode ipsec ipv4
- tunnel destination 203.0.113.2
- tunnel protection ipsec profile IPSEC-PROF
FortiGate Side
- config vpn ipsec phase1-interface
- edit "VPN-CISCO"
- set interface "port10"
- set ike-version 2
- set peertype any
- set remote-gw 203.0.113.1
- set psksecret SharedKey123
- set proposal aes256gcm-sha384
- set dhgrp 19
- next
- config vpn ipsec phase2-interface
- edit "VPN-CISCO-P2"
- set phase1name "VPN-CISCO"
- set proposal aes256gcm-sha384
- set dhgrp 19
- set src-subnet 192.168.1.0 255.255.255.0
- set dst-subnet 10.0.0.0 255.255.255.0
- next
Troubleshooting
- Cisco: show crypto ikev2 sa (phase 1)
- Cisco: show crypto ipsec sa (phase 2)
- debug crypto ikev2 error
- FortiGate: diagnose vpn ike gateway list
- FortiGate: diagnose vpn tunnel list
- Check: ping through the tunnel
Common Issues
- Proposal mismatch: check encryption + integrity + DH on both sides
- Mismatched PSK
- NAT-T: enable on both sides
- Intermediate firewall blocking UDP 500/4500
- Proxy IDs (traffic selectors) do not match
Order from OPTINOC
Multi-vendor IPsec VPN configuration: Cisco, FortiGate, Palo Alto, Juniper and Stormshield. Diagnosis within 2 hours.