How to Set Up a FortiGate IPsec IKEv2 Site‑to‑Site VPN: A Simple Guide

Connecting two remote offices with a secure tunnel can feel like threading a needle—especially when you’re staring at a FortiGate console for the first time. The good news? IKEv2‑based IPsec is designed to be resilient, and FortiGate’s CLI and GUI give you enough flexibility to get the job done without a PhD in cryptography. Below is a walk‑through that assumes you have two FortiGate units, basic network connectivity, and a need to protect traffic between them.

Why Choose IKEv2 for Your Site‑to‑Site Tunnel?

IKEv2 brings a handful of perks that matter in real‑world deployments:

• Faster re‑keying—the tunnel can refresh its keys without dropping sessions.
• Better NAT traversal—useful if one side sits behind a router that rewrites ports.
• Built‑in mobility support—handy for connections that may change IP addresses occasionally.

In short, you get a sturdier tunnel with less manual tweaking.

Pre‑Deployment Checklist

Before you dive into the configuration, run through this quick list:

• Both FortiGates run a supported firmware (typically 6.2+ for full IKEv2 support).
• Public IP addresses or resolvable DNS names for each device.
• Shared secret (pre‑shared key) agreed upon by both sides.
• Define the subnets that will travel through the tunnel—keep the list tight to avoid routing loops.
• Make sure any upstream firewall allows UDP 500 and 4500 traffic.

Step‑by‑Step: Configuring the Tunnel via GUI

1. Create the Phase 1 Interface

Navigate to VPN > IPsec Tunnels > Create New. Choose “Custom” to get full control.

• Name: SiteA‑to‑SiteB
• Remote Gateway: select “Static IP” and enter the partner’s public address.
• Authentication Method: Pre‑Shared Key – type the secret you decided on.
• IKE Version: IKEv2.
• Set the Encryption to AES‑256 and Hash to SHA‑256 for a good security‑performance balance.
• Leave the DH Group at 14 (modp2048) unless you have a specific compliance requirement.

2. Define Phase 2 Parameters

After saving Phase 1, click “Add Phase 2.” Here you tell the tunnel which traffic is allowed.

• Name: SiteA‑to‑SiteB‑Phase2
• Local Subnet: e.g., 10.1.0.0/16
• Remote Subnet: e.g., 10.2.0.0/16
• Match the Phase 1 encryption and hash settings.
• Enable Replay Detection and Anti‑Replay for extra safety.

3. Configure Static Routes

Both devices need a route that points the remote subnet to the newly created tunnel interface.

• Go to Network > Static Routes.
• Add a route: Destination 10.2.0.0/16, Interface SiteA‑to‑SiteB, Distance 10.
• Do the mirror on the opposite FortiGate (swap local/remote subnets).

4. Adjust Firewall Policies

The tunnel won’t carry traffic until you permit it.

• Create an inbound policy on each unit: Source 10.1.0.0/16, Destination 10.2.0.0/16, Service ALL, Action IPsec.
• Mirror the policy on the other side, swapping the subnets.
• If you want to log traffic, enable logging on the policy for troubleshooting.

Command‑Line Option: One‑Liner for the Core Tunnel

If you prefer the CLI, the following snippet creates a basic IKEv2 tunnel in just a few lines. Adjust the IPs, subnets, and PSK as needed.

config vpn ipsec phase1-interface
edit "SiteA-to-SiteB"
set type static
set interface "wan1"
set remote-gw 203.0.113.45
set psksecret "MyStrongPsk123!"
set proposal aes256-sha256
set dhgrp 14
set ike-version 2
next
end
config vpn ipsec phase2-interface
edit "SiteA-to-SiteB-p2"
set phase1name "SiteA-to-SiteB"
set proposal aes256-sha256
set src-subnet 10.1.0.0 255.255.0.0
set dst-subnet 10.2.0.0 255.255.0.0
next
end
config router static
edit 0
set dst 10.2.0.0/16
set device "SiteA-to-SiteB"
next
end

Copy the block to the opposite FortiGate, swapping the IPs and subnets, and you’re essentially done.

Testing the Tunnel

After committing the changes, you’ll want to verify that the tunnel is alive:

• In the GUI, go to VPN > Monitor > IPsec Monitor—a green status means the SA (Security Association) is up.
• From a host in 10.1.0.0/16, ping a host in 10.2.0.0/16. Successful replies confirm traffic is flowing.
• If pings fail, check the Log & Report > Event Log > VPN for IKE negotiation messages.

Common Pitfalls and How to Avoid Them

Mismatch in Phase 2 selectors. Even a single IP off will keep the tunnel from establishing. Double‑check subnet masks.

UDP 4500 blocked. Some edge routers silently drop NAT‑T traffic. Make sure the upstream device permits both UDP 500 and 4500.

Forgot to enable NAT Traversal. In environments where either side sits behind NAT, toggle the “Enable NAT Traversal” checkbox in Phase 1.

Keeping the Tunnel Secure Over Time

Security isn’t a set‑and‑forget operation. Here are a few low‑effort habits:

• Rotate the pre‑shared key every six months. A quick CLI command can push the new key to both units.
• Enable Dead Peer Detection (DPD) so dead tunnels are torn down automatically.
• Schedule a firmware upgrade window—new FortiOS releases often include hardening for IKEv2.

With the basics in place, you can now explore advanced features like split tunneling or dynamic routing (BGP/OSPF) over the VPN if your network grows.