VPN IPSec/SSL, filtrage web, contrôle d'applications, IPS/IDS — sécurisez votre infrastructure
IKEv1 vs IKEv2, SA, DH Groups, chiffrement, authentification
Le VPN IPSec se compose de deux phases :
| Phase | Nom | Fonction |
|---|---|---|
| Phase 1 (IKE SA) | Main / Aggressive | Établissement du tunnel management — négociation des paramètres de sécurité |
| Phase 2 (IPSec SA) | Quick Mode | Établissement du tunnel de données — chiffrement du trafic réel |
IKEv2 est recommandé car il est plus rapide et plus sécurisé qu'IKEv1.
# Parametres phases
Phase 1: IKE (Port UDP 500/4500)
- Mode: Main ou Aggressive
- Encryption: AES-128/256, 3DES
- Hash: SHA-256/512, MD5
- DH Group: 14 (2048 bits) minimum recommande
- Authentication: PSK ou Certificate
- Keepalive: DPD (Dead Peer Detection)
Phase 2: IPSec (Protocol ESP ou AH)
- Encryption: AES-128/256, 3DES
- Hash: SHA-256/512
- PFS (Perfect Forward Secrecy): DH Group 14+
- Protocol: ESP (recommande)La phase 1 négocie le canal de gestion IKE SA, la phase 2 négocie le canal de données IPSec SA en ESP qui chiffre le trafic utile.
Configuration complète, phase 1 et 2,-routeur et tunnel
# === Phase 1 ===
FGT60F # config vpn ipsec phase1-interface
FGT60F (phase1-interface) # edit "Branch_to_HQ"
FGT60F (Branch_to_HQ) # set interface "port1"
FGT60F (Branch_to_HQ) # set ike-version 2
FGT60F (Branch_to_HQ) # set remote-gw 203.0.113.10
FGT60F (Branch_to_HQ) # set preshare-key "MonSecret123!"
FGT60F (Branch_to_HQ) # set proposal aes256-sha256
FGT60F (Branch_to_HQ) # set dhgrp 14 20
FGT60F (Branch_to_HQ) # set local-gw 192.168.1.100
FGT60F (Branch_to_HQ) # set remote-gw 203.0.113.10
FGT60F (Branch_to_HQ) # set dpd on-idle
FGT60F (Branch_to_HQ) # set auto-negotiate enable
FGT60F (Branch_to_HQ) # next
FGT60F (phase1-interface) # end
# === Phase 2 ===
FGT60F # config vpn ipsec phase2-interface
FGT60F (phase2-interface) # edit "Branch_to_HQ_P2"
FGT60F (Branch_to_HQ_P2) # set phase1name "Branch_to_HQ"
FGT60F (Branch_to_HQ_P2) # set proposal aes256-sha256
FGT60F (Branch_to_HQ_P2) # set pfs enable
FGT60F (Branch_to_HQ_P2) # set dhgrp 14 20
FGT60F (Branch_to_HQ_P2) # set src-addr-type subnet
FGT60F (Branch_to_HQ_P2) # set dst-addr-type subnet
FGT60F (Branch_to_HQ_P2) # set src-subnet 10.0.1.0/24
FGT60F (Branch_to_HQ_P2) # set dst-subnet 10.10.0.0/24
FGT60F (Branch_to_HQ_P2) # next
FGT60F (phase2-interface) # end
# === Route statique vers le tunnel ===
FGT60F # config router static
FGT60F (static) # edit 100
FGT60F (100) # set dst 10.10.0.0/24
FGT60F (100) # set device "Branch_to_HQ"
FGT60F (100) # next
FGT60F (static) # end
# === Regle de pare-feu pour le tunnel ===
FGT60F # config firewall policy
FGT60F (policy) # edit 50
FGT60F (50) # set name "IPSec_Branch_to_HQ"
FGT60F (50) # set srcintf "port2"
FGT60F (50) # set dstintf "Branch_to_HQ"
FGT60F (50) # set srcaddr "LAN_Net"
FGT60F (50) # set dstaddr "HQ_Net"
FGT60F (50) # set service "ALL"
FGT60F (50) # set action accept
FGT60F (50) # set logtraffic all
FGT60F (50) # next
FGT60F (policy) # end
# Verifier le statut du tunnel
FGT60F # get vpn ipsec saLa route statique vers le tunnel et la politique de port2 vers l interface VPN avec les bons objets source et destination.
PKI, certificats, CA, authentification par certificat
# Importer un certificat CA
FGT60F # config vpn certificate ca
FGT60F (ca) # edit "MyCA"
FGT60F (MyCA) # set ca "-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----"
FGT60F (MyCA) # next
FGT60F (ca) # end
# Generer un CSR (Certificate Signing Request)
FGT60F # config vpn certificate local
FGT60F (local) # edit "FGT60F_Cert"
FGT60F (FGT60F_Cert) # set key-type rsa
FGT60F (FGT60F_Cert) # set key-size 2048
FGT60F (FGT60F_Cert) # set subject "CN=fgt60f.example.com"
FGT60F (FGT60F_Cert) # set san "fgt60f.example.com"
FGT60F (FGT60F_Cert) # set curve-prime256v1
FGT60F (FGT60F_Cert) # next
FGT60F (local) # end
# Phase 1 avec certificat
FGT60F # config vpn ipsec phase1-interface
FGT60F (phase1-interface) # edit "VPN_Cert"
FGT60F (VPN_Cert) # set certificate "FGT60F_Cert"
FGT60F (VPN_Cert) # set peertype "any"
FGT60F (VPN_Cert) # set peer "peer-cert"
FGT60F (VPN_Cert) # set clientcert-type dssignature
FGT60F (VPN_Cert) # next
FGT60F (phase1-interface) # endPlus aucun secret partagé à distribuer, chaque site a son identité propre, renouvelable et révocable centralement via la PKI.
Debug IKE, status SA, erreurs courantes
# Verifier le statut SA
FGT60F # get vpn ipsec sa
FGT60F # get vpn ipsec sa details
# Activer le debug IKE
FGT60F # diagnose debug application ike -1
FGT60F # diagnose debug enable
# Desactiver le debug
FGT60F # diagnose debug disable
FGT60F # diagnose debug application ike 0
# Debug specifique a une phrase
FGT60F # diagnose debug application ike 255
FGT60F # diagnose debug enable
# DSNAT leak troubleshooting
FGT60F # diagnose vpn tunnel gateway list
FGT60F # diagnose vpn gateway flush
# Voir les statistiques du tunnel
FGT60F # diagnose vpn ike restart
FGT60F # execute inteface湾湾湾湾
# Flusher les sessions IPSec
FGT60F # diagnose sys session filter tunnel ipsec
FGT60F # diagnose sys session clear
# Commandes utiles
FGT60F # diagnose vpn error info
FGT60F # diagnose vpn ike listLes proposals phase 1 ou 2 diffèrent entre pairs, il faut aligner encryption, hash, DH et PFS des deux côtés puis renégocier.
Portail web, tunnel mode, split tunneling
Le SSL-VPN permet aux utilisateurs distants de se connecter au réseau via le navigateur web ou le client FortiClient.
# Configurer les parametres SSL-VPN
FGT60F # config vpn ssl settings
FGT60F (settings) # set status enable
FGT60F (settings) # set port 10443
FGT60F (settings) # set source-interface "port1"
FGT60F (settings) # set source-address "all"
FGT60F (settings) # set default-portal "full-access"
FGT60F (settings) # set authentication-timeout 28800
FGT60F (settings) # set tunnel-ip-pool "SSLVPN_TUNNEL_IPv4"
FGT60F (settings) # set dns-server1 8.8.8.8
FGT60F (settings) # set dns-server2 8.8.4.4
FGT60F (settings) # set dns-suffix "example.local"
FGT60F (settings) # set tunnel-split-tunnel enable
FGT60F (settings) # end
# Creer un user SSL-VPN
FGT60F # config user local
FGT60F (local) # edit "vpnuser01"
FGT60F (vpnuser01) # set type password
FGT60F (vpnuser01) # set passwd "P@ssw0rd123!"
FGT60F (vpnuser01) # set profile "sslvpn_profile"
FGT60F (vpnuser01) # next
FGT60F (local) # end
# Creer un user group SSL-VPN
FGT60F # config user group
FGT60F (group) # edit "SSLVPN_Users"
FGT60F (SSLVPN_Users) # set member "vpnuser01"
FGT60F (SSLVPN_Users) # set internal -portal "full-access"
FGT60F (SSLVPN_Users) # next
FGT60F (group) # end
# Regle de pare-feu pour le SSL-VPN
FGT60F # config firewall policy
FGT60F (policy) # edit 60
FGT60F (60) # set name "SSLVPN_to_LAN"
FGT60F (60) # set srcintf "ssl.root"
FGT60F (60) # set dstintf "port2"
FGT60F (60) # set srcaddr "SSLVPN_TUNNEL_IPv4"
FGT60F (60) # set dstaddr "LAN_Net"
FGT60F (60) # set service "ALL"
FGT60F (60) # set action accept
FGT60F (60) # set logtraffic all
FGT60F (60) # next
FGT60F (policy) # endSeul le trafic vers le réseau interne passe par le VPN, Internet sort en local, ce qui préserve la bande passante et la confidentialité utile.
FortiClient EMS, provisioning, split tunnel
FortiClient est le client VPN officiel Fortinet, disponible pour Windows, macOS, Linux, iOS et Android.
# Verifier les sessions SSL-VPN
FGT60F # get vpn ssl settings | grep -i status
status: enable
# Lister les utilisateurs connectes
FGT60F # execute vpn sslvpn user-list
# Kicker un utilisateur
FGT60F # execute vpn sslvpn user-delete Avec execute vpn sslvpn user-list pour lister, puis execute vpn sslvpn user-delete avec le nom d utilisateur pour couper la session.
Personnalisation des portails, bookmark, realm
# Creer un portail customise
FGT60F # config vpn ssl web portal
FGT60F (portal) # edit "Restricted_Access"
FGT60F (Restricted_Access) # set web-mode enable
FGT60F (Restricted_Access) # set tunnel-mode disable
FGT60F (Restricted_Access) # set ip-pool enable
FGT60F (Restricted_Access) # set ip-pools "SSLVPN_TUNNEL_IPv4"
FGT60F (Restricted_Access) # config bookmark
FGT60F (bookmark) # edit 1
FGT60F (1) # set name "Serveur_RDP"
FGT60F (1) # set type rdp
FGT60F (1) # set host 10.0.1.50
FGT60F (1) # set port 3389
FGT60F (1) # set login-text "Connexion RDP"
FGT60F (1) # next
FGT60F (bookmark) # end
FGT60F (Restricted_Access) # next
FGT60F (portal) # end
# Associer un portail a un user group
FGT60F # config user group
FGT60F (group) # edit "SSLVPN_Limited"
FGT60F (SSLVPN_Limited) # set member "vpnuser01"
FGT60F (SSLVPN_Limited) # set internal -portal "Restricted_Access"
FGT60F (SSLVPN_Limited) # next
FGT60F (group) # endL utilisateur n accède qu à l application publiée via le navigateur, sans tunnel complet vers tout le réseau interne.
Catégories URL, whitelist/blacklist, FortiGuard Web Filter
# Configurer le profil Web Filter
FGT60F # config webfilter profile
FGT60F (profile) # edit "Strict_Filter"
FGT60F (Strict_Filter) # set comment "Filtrage strict"
FGT60F (Strict_Filter) # config web
FGT60F (web) # set bword-block-on
FGT60F (web) # set bword-table 0
FGT60F (web) # end
# Configurer les catégories FortiGuard
FGT60F # config webfilter fortiguard
FGT60F (fortiguard) # set category -default -action allow
FGT60F (fortiguard) # set category -bandwidth action block
FGT60F (fortiguard) # set category -malware action block
FGT60F (fortiguard) # set category -phishing action block
FGT60F (fortiguard) # set category -proxy-avoidance action block
FGT60F (fortiguard) # end
# Creer des entries blacklist
FGT60F # config webfilter urlfilter
FGT60F (urlfilter) # edit 1
FGT60F (1) # config entries
FGT60F (entries) # edit 1
FGT60F (1) # set url "*.malware.com"
FGT60F (1) # set type wildcard
FGT60F (1) # set action block
FGT60F (1) # next
FGT60F (entries) # edit 2
FGT60F (2) # set url "social-media.com"
FGT60F (2) # set action block
FGT60F (2) # next
FGT60F (entries) # end
FGT60F (1) # next
FGT60F (urlfilter) # endCréer une exception whitelist précise, logger, faire recatégoriser chez FortiGuard et réévaluer au lieu d ouvrir toute la catégorie.
Signature d'applications, catégories, filtrage P2P/streaming
# Creer un profil Application Control
FGT60F # config application list
FGT60F (list) # edit "AppControl_Strict"
FGT60F (AppControl_Strict) # set comment "Controle strict des applications"
FGT60F (AppControl_Strict) # config entries
FGT60F (entries) # edit 1
FGT60F (1) # set application 15787
FGT60F (1) # set action block
FGT60F (1) # set log enable
FGT60F (1) # next
FGT60F (entries) # edit 2
FGT60F (2) # set application 15833
FGT60F (2) # set action monitor
FGT60F (2) # next
FGT60F (entries) # edit 3
FGT60F (3) # set application 15861
FGT60F (3) # set action block
FGT60F (3) # next
FGT60F (entries) # end
FGT60F (AppControl_Strict) # next
FGT60F (list) # end
# Appliquer sur une regle
FGT60F # config firewall policy
FGT60F (policy) # edit 1
FGT60F (1) # set application-list "AppControl_Strict"
FGT60F (1) # next
FGT60F (policy) # endParce qu elles utilisent les ports 80 et 443 communs et se masquent en HTTPS, seule la signature applicative permet de les distinguer.
DNS Filter, sandboxing DNS, block categories
# Configurer DNS Filter
FGT60F # config dnsfilter profile
FGT60F (profile) # edit "Secure_DNS"
FGT60F (Secure_DNS) # set comment "DNS Filter securise"
FGT60F (Secure_DNS) # config ftgd-dns
FGT60F (ftgd-dns) # set options translate-ip
FGT60F (ftgd-dns) # config filter
FGT60F (filter) # edit 1
FGT60F (1) # set category 2
FGT60F (1) # set type domain
FGT60F (1) # set action block
FGT60F (1) # next
FGT60F (filter) # end
FGT60F (ftgd-dns) # end
FGT60F (Secure_DNS) # next
FGT60F (profile) # end
# Appliquer sur une interface
FGT60F # config system dns-server
FGT60F (dns-server) # edit port2
FGT60F (port2) # set type regular
FGT60F (port2) # set interface "port2"
FGT60F (port2) # set dnsfilter-profile "Secure_DNS"
FGT60F (port2) # endUn poste probablement compromis qui tente de joindre son infrastructure, à isoler et analyser avant réintégration.
Signature, anomaly detection, FortiGuard IPS
FortiGate intègre un IPS/IDS basé sur les signatures FortiGuard et la détection d'anomalies.
| Mode | Description | Usage |
|---|---|---|
| IDS (détection) | Alerte sans bloquer | Phase de test, audit |
| IPS (prévention) | Bloque les attaques | Production |
En phase de test et d audit pour mesurer les détections sans impacter la production, avant de basculer en prévention.
Sensors, signatures, sensibilité, action
# Creer un IPS Sensor
FGT60F # config ips sensor
FGT60F (sensor) # edit "Custom_IPS"
FGT60F (Custom_IPS) # set comment "IPS personnalise"
FGT60F (Custom_IPS) # config entries
FGT60F (entries) # edit 1
FGT60F (1) # set signature "SSH.CS.SSH"
FGT60F (1) # set action pass
FGT60F (1) # set status enable
FGT60F (1) # next
FGT60F (entries) # edit 2
FGT60F (2) # set signature "HTTP.CS.RCE"
FGT60F (2) # set action block
FGT60F (2) # set status enable
FGT60F (2) # set severity high critical
FGT60F (2) # next
FGT60F (entries) # end
FGT60F (Custom_IPS) # next
FGT60F (sensor) # end
# Appliquer l'IPS sur une regle
FGT60F # config firewall policy
FGT60F (policy) # edit 1
FGT60F (1) # set ips-sensor "Custom_IPS"
FGT60F (1) # set logtraffic all
FGT60F (1) # next
FGT60F (policy) # end
# Mettre a jour les signatures IPS
FGT60F # execute fab update execute fortiguardCréer une entrée dédiée en pass ou disable pour cette signature, limitée aux sources concernées, loggée et réévaluée périodiquement.
Logs IPS, alertes, analyse des attaques
# Voir les logs IPS
FGT60F # execute log filter field type ips
FGT60F # execute log display
# Voir les signatures bloquees
FGT60F # execute log filter field action blocked
FGT60F # execute log display
# Statistiques IPS
FGT60F # diagnose ips stats show
# Exclure temporairement une signature
FGT60F # config ips sensor
FGT60F (sensor) # edit "Custom_IPS"
FGT60F (Custom_IPS) # config entries
FGT60F (entries) # edit 10
FGT60F (10) # set signature "SSH.CS.SSH"
FGT60F (10) # set action pass
FGT60F (10) # set status disable
FGT60F (10) # next
FGT60F (entries) # end
FGT60F (Custom_IPS) # next
FGT60F (sensor) # endVérifier la criticité, isoler le serveur, analyser les logs, patcher la faille, puis ajuster le capteur au lieu de le désactiver globalement.