A while ago I have posted a blog post how to connect a FortiGate with a Meraki MX.( https://freddejonge.nl/fortinet-to-meraki-site-2-site-vpn/) That post was based on an IKEv1 configuration and some outdated encryption technologies. Hereby I post a new version of a Site-2-Site connection between a FortiGate and a Meraki MX.
The Site-2-Site connection on a Meraki MX is a global organization setting for the VPN This could cause some challenges if you want to add multiple sites of an Meraki MX with a FortiGate.. It might be smart to use an remote id to identify the correct VPN tunnel.
FortiGate configuration
Starting with the configuration on the FortiGate part of the Site-2-Site connection.
Create a new custom VPN tunnel:
Give the VPN tunnel a name and select Template Type: Custom
Use the settings above to make the start of phase 1:
* IP address should be your remote endpoint
Select IKE version 2 and enter your pre-shared key.
Choose Encryption AES256
Choose Authentication SHA256
Diffie-Hellman Group: 14 ( meraki is only able to do 1,2,5,14,15 and 21) In my setup I choose 14.
Key Lifetime (seconds) 1800 (this will help to improve the connection speed)
Local ID: only when needed.
Enter a name for the Phase 2 connection
Enter the local ip address range: example 10.0.0.0/24
Enter the remote ip address range: example 10.1.0.0/24
Select only Encryption AES256
Select only Authentication AES256
Select Diffie-Hellman Group: same as phase1 (14)
Select Authe-negotiate (enabled)
Key lifetime in seconds: 3600
If you have multiple networks then you need to do phase 2 steps multiple times
Save the configuration
If you have multiple networks then you need to do phase 2 steps multiple times
Create a static route for the VPN tunnel
Enter the remote IP address range and select the proper VPN tunnel to connect
Save the configuratioen
Create the needed firewall policies from and to the VPN tunnel to allow the correct range of traffic.
Meraki Configuration
Login to the Meraki Dashboard environment. Go to the Security & SD-WAN > Site-2-Site VPN
In this section you have to first activate AutoVPN. It’s not possible to create a third-party VPN without enabling this feature.
Select Hub if it’s the first MX in the environment
Select the local networks which are allowed to access the VPN tunnel.
Keep these settings default.
Add new Peer
This is an organization wide configuration!!
Name: Mandatory to enter
Select IKE version: IKEv2
Enter a Public IP address or Hostname
Enter a Shared secret
Routing select: static
Private subnets: Remote IP range which you want to reacht
Availability select all networks if you have only 1 network otherwise select the appropriate network.
IPsec Policy: Custom
Phase 1:
AES 256
SHA256
Pseudo-random function: Defaults to Authentication
Diffie-Hellman group: 14
Lifetime: 1800
Phase 2:
AES256
SHA256
PHS group: 14
Lifetime: 3600
Save the configuration
To see if the VPN tunnel is up go to
Security & SD-WAN followed VPN Status
You can see if the status is green. if the status is red then you need to troubleshoot the configuration.