Joe Poyzer

Specializing in networking, systems, cloud, and automation.

📌 Overview

This was the hands-on project completed after earning the Fortinet NSE 7 Enterprise Firewall Administrator certification — building a Site-to-Site IPsec VPN tunnel between two FortiGates, then running OSPF as a dynamic routing protocol over the tunnel rather than relying on static routes.

Environment:

  • 2x FortiGate VMs, hosted on a Hyper-V server
  • Site-to-Site IPsec VPN tunnel between the two FortiGates
  • OSPF running over the IPsec tunnel interface

🔧 Objectives

  • Establish a Site-to-Site IPsec VPN tunnel between two virtual FortiGate instances
  • Configure OSPF to run dynamically over the IPsec tunnel interface
  • Form OSPF adjacency across the tunnel and verify route exchange
  • Validate that routes learned via OSPF are correctly installed and traffic routes as expected across the tunnel

🔒 Building the IPsec Tunnel

The first phase was establishing a stable Site-to-Site IPsec tunnel between the two FortiGate VMs — configuring Phase 1 (IKE) parameters for the tunnel negotiation itself, and Phase 2 parameters defining the traffic selectors and encryption settings for the actual data traversing the tunnel.

🔄 Running OSPF Over the Tunnel

Rather than relying on static routes to reach networks on the far side of the tunnel — the more common, simpler approach — OSPF was configured to run directly over the IPsec tunnel interface. This meant treating the tunnel interface like any other OSPF-enabled interface, forming a neighbor adjacency across it, and letting routes propagate dynamically rather than being manually maintained.

This is a more advanced and more resilient design than static routing: if the topology on either side changes (new subnets added, routes removed), OSPF adapts automatically rather than requiring manual route updates on both FortiGates every time something changes.

📈 Results

  • Stable Site-to-Site IPsec tunnel established between both FortiGate VMs
  • OSPF neighbor adjacency formed successfully across the tunnel interface
  • Routes learned dynamically via OSPF and correctly installed in the routing table on both sides
  • Validated end-to-end connectivity and traffic routing across the tunnel using OSPF-learned routes

📝 Notes / Lessons Learned

  • Running a dynamic routing protocol over a VPN tunnel requires the tunnel interface to be treated the same as a physical interface for routing purposes — adjacency formation depends on the tunnel being stable first
  • OSPF over IPsec is significantly more scalable than static routing for environments where the network topology on either end is expected to change over time
  • Getting Phase 1/Phase 2 IPsec parameters correct is a prerequisite for everything else — a flapping or unstable tunnel will prevent OSPF adjacency from ever forming reliably, so tunnel stability has to be confirmed before troubleshooting routing