Fortigateを使用したOCI IPSec VPN接続例

## 概要
Fortigateを使用してOCIにIPSec VPNで接続する設定例です。

## 構成

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/4141b327-3c45-5a94-d33b-876305d9e00c.png)

## 設定例
* OCI
OCIメニューからネットワーキング>>サイト間VPNを選択します。
作成については以下のサイトをご参照ください。
サイト間VPNの設定
https://docs.oracle.com/ja-jp/iaas/Content/Network/Tasks/settingupIPsec.htm

ここでは作成済みの設定となります。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/37dfd476-e145-592e-710d-b507b1d8c184.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/80a1d3ad-8a89-b227-099d-87a24ec2d97c.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/c6d5308f-7023-1279-607e-5fa7148b99ce.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/1feb15f1-3161-88cc-44e0-ed8c1993efd6.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/8006dc0b-c016-44db-fa04-0942a5cf3578.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/0e3f4d0a-f6a6-64cc-f25e-71da4f912012.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/e4143b89-b4aa-6f35-a5c9-b4d14e7d1732.png)

* Fortigate
FortiGate 50E  ファームウェアバージョンは6.2.12 build 1319です。
Policyや冗長化等を環境に応じて設定が必要です。
InterfaceやVPN設定
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/cffef5ac-3f6f-a751-b44b-0787ce3ddfab.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/3589ea06-d4a4-0d44-3ed4-b68293fa9041.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/402675be-fa7f-0872-d5ac-e3c8681dceb4.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/36801ee3-09f6-3b38-32e1-255b67f3089c.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/bb8e863b-11e6-ac6f-3a38-c5fb54cd1b4a.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/f9b94ee0-90a8-faaa-77ad-0b4d6c69841b.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/8f85e43c-ec3c-93ee-e24a-815069b5dd20.png)

Policy設定
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/b4de868c-a931-1526-e80c-c9376b6a1dc6.png)

IPSec tunnelのmssを調整する必要がある場合は以下で変更が可能です。
``` 
#WAN IFのMTUを調整する場合の例
config system interface
    edit wan1
        set mtu-override enable
        set mtu 1340
end
#MSSを調整する場合はPolicyごとに設定が必要とのことです
以下はmss=1300に調整しています
config firewall policy
    edit 6
        set tcp-mss-sender 1300
        set tcp-mss-receiver 1300
end
    edit 7
        set tcp-mss-sender 1300
        set tcp-mss-receiver 1300
end

```

IPSec状況
statusがupしています
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2730992/36ef6f5c-0a53-78d5-9e8d-26dd534071c5.png)

* Pingテスト
OCIサーバーからオンプレへのping結果
``` Server.
[user@linux ~]$ ping 192.168.100.102
PING 192.168.100.102 (192.168.100.102) 56(84) bytes of data.
64 bytes from 192.168.100.102: icmp_seq=1 ttl=125 time=56.6 ms
64 bytes from 192.168.100.102: icmp_seq=2 ttl=125 time=54.9 ms
^C
--- 192.168.100.102 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 54.931/55.774/56.617/0.843 ms
[user@linux ~]$

```