本指南提供了关于如何结合 Fortinet FortiGate 防火墙配置带有 IPsec 隧道的 Cloudflare WAN（前称 Magic WAN）的信息和示例。
此处介绍的 FortiGate 配置设置支持 Cloudflare WAN 所需的双向健康检查。然而，它们并未考虑隧道健康检查之外的任何其他流量流向。可能需要根据您当前的 FortiGate 配置对该配置进行调整。
FortiGate 配置在两台不同的 FortiGate 防火墙上进行了测试：
- FortiGate 虚拟设备版本 7.0.8，运行于 VMware ESXi 6.5
- FortiGate FG80F，版本 7.0.12
要设置 Cloudflare WAN，请使用仪表板或 API 将 IPsec 隧道和静态路由添加到您的 Cloudflare 账户中。
在继续之前，请确保已为您的账户分配了 IPv4 Anycast 地址。您可以在 Cloudflare 仪表板中的地址空间 > 租用 IP ↗ 下找到它。
Cloudflare 会通过从全球许多分布式数据中心的多台节点宣告您的端点 IP 来自动处理其网络上的故障。为了处理您网络上的故障，请从不同的路由器配置两条 IPsec 隧道。
- 按照添加隧道说明创建所需的 IPsec 隧道，并定义以下选项：
- 健康检查类型：更改为 Request。
- 重放保护：不要更改默认设置。
添加两条静态路由以定义 IPsec 隧道背后的 IP 地址空间 — 每个路由对应上一节中定义的两条 IPsec 隧道之一。
默认情况下，静态路由被定义为优先级（Priority）设置为 100。Cloudflare 利用等值多路径路由（ECMP），并会在两条隧道之间对等分担流量。如果您更倾向于使用主动/被动 (Active/Passive) 模型，您可以将第一条路由的默认值保留为 100，并将第二条隧道的优先级值设置为 150（值越高，优先级越低）。
按照配置静态路由说明创建一条静态路由。
-
对于第一条路由，确保定义了以下设置：
- 前缀：指定存在于您在上一节中定义的第一条 IPsec 隧道背后的 RFC 1918 ↗ 子网。
- 隧道/下一跳：选择您的第一条隧道（Tunnel 01/02）。
-
对于第二条路由，确保定义了以下设置：
- 前缀：指定存在于上一节中定义的第二条 IPsec 隧道背后的 RFC 1918 ↗ 子网。
- 隧道/下一跳：选择您的第二条隧道（Tunnel 02/02）。
为 ICMP 启用不对称路由 (asymmetric routing)，以确保健康检查按预期工作。此选项是必需的。否则，对 Cloudflare WAN 正常运行至关重要的隧道健康检查将无法按设计运行。
启用不对称路由将影响 FortiGate 的行为。要了解更多信息，请参阅启用不对称路由时 FortiGate 的行为方式 ↗。
config system settings
set asymroute-icmp enable
end如果您的网络上有网络地址转换穿越（NAT-T），您可以启用此功能并在端口 4500 上发起因特网密钥交换 (IKE) 通信。
要设置 IKE 端口，请将以下内容添加到您的系统设置中：
config system settings
set ike-port 4500
end要启用 NAT-T，请将 set nattraversal enable 添加到您正在配置的 IPsec 隧道中。
fortigate # config vpn ipsec phase1-interface
edit "<NAME_OF_YOUR_TUNNEL>"
set nattraversal enable有关更多详细信息，请参阅 Fortinet 文档 ↗。
对于基于路由的 IPsec 配置，您需要禁用防重放保护。以下命令全局禁用防重放保护，但您也可以针对每个防火墙策略进行此设置。要了解更多信息，请参阅 Fortinet 关于每个策略的防重放支持 ↗文档。
config system global
set anti-replay disable
endIPsec 隧道采用基于路由的站点到站点虚拟专用网 (VPN) 模型。该模型依靠使用虚拟隧道接口和路由来定义穿越 IPsec 隧道的流量。
使用 phase1-interface 和 phase2-interface 对象配置两条 IPsec 隧道。
以下示例假设 wan1 是 FortiGate 防火墙的外部/出口接口。
MWAN_IPsec_Tun1 对应于之前在配置的 Cloudflare 部分中添加的 Tunnel 01/02。MWAN_IPsec_Tun2 对应于之前在配置的 Cloudflare 部分中添加的 Tunnel 02/02。
fortigate # config vpn ipsec phase1-interface
edit "MWAN_IPsec_Tun1"
set interface "wan1"
set ike-version 2
set keylife 86400
set peertype any
set net-device enable
set proposal aes256gcm-prfsha512 aes256gcm-prfsha384 aes256gcm-prfsha256
set localid "f1473dXXXXXXX72e33.49561179.ipsec.cloudflare.com"
set dhgrp 20
set nattraversal disable
set remote-gw 162.159.67.210
set add-gw-route enable
set psksecret <YOUR_PRE-SHARED_KEY>
next
edit "MWAN_IPsec_Tun2"
set interface "wan1"
set ike-version 2
set keylife 86400
set peertype any
set net-device enable
set proposal aes256gcm-prfsha512 aes256gcm-prfsha384 aes256gcm-prfsha256
set localid "de91565XXXXXXXfbbd6632.49561179.ipsec.cloudflare.com"
set dhgrp 20
set nattraversal disable
set remote-gw 172.XX.XX.210
set add-gw-route enable
set psksecret ENC <YOUR_PRE-SHARED_KEY>
next
end按照以下方式为两个 phase1-interfaces 分别添加两个 phase2-interfaces：
fortigate # config vpn ipsec phase2-interface
edit "MWAN_IPsec_Tun1"
set phase1name "MWAN_IPsec_Tun1"
set proposal aes256gcm aes128gcm
set dhgrp 20
set replay disable
set keylifeseconds 28800
set auto-negotiate enable
set keepalive enable
next
edit "MWAN_IPsec_Tun2"
set phase1name "MWAN_IPsec_Tun2"
set proposal aes256gcm aes128gcm
set dhgrp 20
set replay disable
set keylifeseconds 28800
set auto-negotiate enable
set keepalive enable
next
end配置在 phase1-interface 设置中指定 set net-device enable 时自动添加的虚拟隧道接口。
这些是唯一需要添加到虚拟隧道接口的设置：
ip：本地 IP 地址（使用/32子网掩码指定 -255.255.255.255）。remote-ip：与前面在 IPsec 隧道部分指定的接口地址相关联的值（使用/31子网掩码指定 -255.255.255.254）。alias（别名）：此值是可选的。
以下示例假设 wan1 是 FortiGate 防火墙的外部/出口接口。
fortigate # config system interface
edit "MWAN_IPsec_Tun1"
set vdom "root"
set ip 10.252.2.91 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.252.2.90 255.255.255.254
set alias "MWAN_IPsec_Tun1"
set snmp-index 17
set interface "wan1"
next
edit "MWAN_IPsec_Tun2"
set vdom "root"
set ip 10.252.2.93 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.252.2.92 255.255.255.254
set alias "MWAN_IPsec_Tun2"
set snmp-index 18
set interface "wan1"
next
end虚拟隧道接口配置完成后，您应该能够 ping 与 remote-ip 属性关联的 IP 地址。
以下示例显示了在两个虚拟隧道接口上执行 ping 的成功结果：
fortigate # execute ping 10.252.2.90
PING 10.252.2.90 (10.252.2.90): 56 data bytes
64 bytes from 10.252.2.90: icmp_seq=0 ttl=64 time=5.8 ms
64 bytes from 10.252.2.90: icmp_seq=1 ttl=64 time=5.8 ms
64 bytes from 10.252.2.90: icmp_seq=2 ttl=64 time=5.8 ms
64 bytes from 10.252.2.90: icmp_seq=3 ttl=64 time=5.8 ms
64 bytes from 10.252.2.90: icmp_seq=4 ttl=64 time=5.7 ms
--- 10.252.2.90 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 5.7/5.7/5.8 msfortigate # execute ping 10.252.2.92
PING 10.252.2.92 (10.252.2.92): 56 data bytes
64 bytes from 10.252.2.92: icmp_seq=0 ttl=64 time=6.1 ms
64 bytes from 10.252.2.92: icmp_seq=1 ttl=64 time=6.1 ms
64 bytes from 10.252.2.92: icmp_seq=2 ttl=64 time=6.1 ms
64 bytes from 10.252.2.92: icmp_seq=3 ttl=64 time=6.1 ms
64 bytes from 10.252.2.92: icmp_seq=4 ttl=64 time=6.0 ms
--- 10.252.2.92 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 6.0/6.0/6.1 ms此示例配置假设在 FortiGate 防火墙上配置了三个区域。这些区域对象将用于本文档后面引用的策略中：
Trust_Zone：包含 LAN 接口。Untrust_Zone：包含 WAN 接口。Cloudflare_Zone：包含两个 IPsec 隧道接口。
fortigate # config system zone
edit "Cloudflare_Zone"
set intrazone allow
set interface "MWAN_IPsec_Tun1" "MWAN_IPsec_Tun2"
next
edit "Trust_Zone"
set intrazone allow
set interface "internal"
next
edit "Untrust_Zone"
set intrazone allow
set interface "wan1"
next
end创建地址对象以表示 Cloudflare IPv4 地址空间 ↗ 以及双向健康检查 Anycast IP 的对象：
config firewall address
edit "Cloudflare_IPv4_01"
set color 9
set subnet 173.245.48.0 255.255.240.0
next
edit "Cloudflare_IPv4_02"
set color 9
set subnet 103.21.244.0 255.255.252.0
next
edit "Cloudflare_IPv4_03"
set color 9
set subnet 103.22.200.0 255.255.252.0
next
edit "Cloudflare_IPv4_04"
set color 9
set subnet 103.31.4.0 255.255.252.0
next
edit "Cloudflare_IPv4_05"
set color 9
set subnet 141.101.64.0 255.255.192.0
next
edit "Cloudflare_IPv4_06"
set color 9
set subnet 108.162.192.0 255.255.192.0
next
edit "Cloudflare_IPv4_07"
set color 9
set subnet 190.93.240.0 255.255.240.0
next
edit "Cloudflare_IPv4_08"
set color 9
set subnet 188.114.96.0 255.255.240.0
next
edit "Cloudflare_IPv4_09"
set color 9
set subnet 197.234.240.0 255.255.252.0
next
edit "Cloudflare_IPv4_10"
set color 9
set subnet 198.41.128.0 255.255.128.0
next
edit "Cloudflare_IPv4_11"
set color 9
set subnet 162.158.0.0 255.254.0.0
next
edit "Cloudflare_IPv4_12"
set color 9
set subnet 104.16.0.0 255.248.0.0
next
edit "Cloudflare_IPv4_13"
set color 9
set subnet 104.24.0.0 255.252.0.0
next
edit "Cloudflare_IPv4_14"
set color 9
set subnet 172.64.0.0 255.248.0.0
next
edit "Cloudflare_IPv4_15"
set color 9
set subnet 131.0.72.0 255.255.252.0
next
edit "Bidirect_HC_Endpoint_01"
set comment "Bidirectional health check endpoint address"
set color 9
set subnet 172.64.240.253 255.255.255.255
next
edit "Bidirect_HC_Endpoint_02"
set comment "Bidirectional health check endpoint address"
set color 9
set subnet 172.64.240.254 255.255.255.255
next
end创建一个包含所有 Cloudflare IPv4 子网的地址组对象。将以下 CLI 命令复制并粘贴到 SSH 终端中以自动创建这些对象：
config firewall addrgrp
edit "Cloudflare_IPv4_Nets"
set member "Cloudflare_IPv4_01" "Cloudflare_IPv4_02" "Cloudflare_IPv4_03" "Cloudflare_IPv4_04" "Cloudflare_IPv4_05" "Cloudflare_IPv4_06" "Cloudflare_IPv4_07" "Cloudflare_IPv4_08" "Cloudflare_IPv4_09" "Cloudflare_IPv4_10" "Cloudflare_IPv4_11" "Cloudflare_IPv4_12" "Cloudflare_IPv4_13" "Cloudflare_IPv4_14" "Cloudflare_IPv4_15"
set color 9
next
end添加一条防火墙规则以允许与回复（reply）类型双向健康检查相关联的 ICMP 流量。
fortigate (policy) # show
config firewall policy
edit 2
set name "CF_Magic_Health_Checks"
set uuid 80eb76ce-3033-51ee-c5e5-d5a670dff3b3
set srcintf "Cloudflare_Zone"
set action accept
set srcaddr "Cloudflare_IPv4_Nets"
set dstaddr "Bidirect_HC_Endpoint_01" "Bidirect_HC_Endpoint_02"
set schedule "always"
set service "ALL_ICMP"
set logtraffic all
next
end添加基于策略的路由 (policy-based routing) 规则，以确保通过 IPsec 隧道接收的与双向健康检查相关联的流量通过相同的隧道返回。
添加两条基于策略的路由规则，两个 IPsec 隧道各一条。
fortigate # config router policy
edit 1
set input-device "MWAN_IPsec_Tun1"
set srcaddr "all"
set dstaddr "all"
set gateway 10.252.2.90
set output-device "MWAN_IPsec_Tun1"
next
edit 2
set input-device "MWAN_IPsec_Tun2"
set srcaddr "all"
set dstaddr "all"
set gateway 10.252.2.92
set output-device "MWAN_IPsec_Tun2"
next
endCloudflare 仪表板会监控您账户上将流量从 Cloudflare 路由到您源站网络的所有 Anycast 隧道的健康状况。有关更多信息，请参阅在仪表板中检查隧道健康状况。
数据包捕获可确定基于策略的路由规则是否按预期工作。
传入 Tunnel 01/02 的流量应该从相同的隧道流出，如以下示例所示：
fortigate # diagnose sniffer packet any 'host 172.64.240.253' 4
interfaces=[any]
filters=[host 172.64.240.253]
0.601569 MWAN_IPsec_Tun1 in 172.64.240.253 -> 162.158.176.118: icmp: echo reply
0.601585 MWAN_IPsec_Tun1 out 172.64.240.253 -> 162.158.176.118: icmp: echo reply
0.611164 MWAN_IPsec_Tun1 in 172.64.240.253 -> 172.71.87.94: icmp: echo reply
0.611178 MWAN_IPsec_Tun1 out 172.64.240.253 -> 172.71.87.94: icmp: echo reply
0.617562 MWAN_IPsec_Tun1 in 172.64.240.253 -> 172.71.129.214: icmp: echo reply
0.617574 MWAN_IPsec_Tun1 out 172.64.240.253 -> 172.71.129.214: icmp: echo reply
0.622042 MWAN_IPsec_Tun1 in 172.64.240.253 -> 172.69.61.43: icmp: echo reply
0.622056 MWAN_IPsec_Tun1 out 172.64.240.253 -> 172.69.61.43: icmp: echo reply
0.624092 MWAN_IPsec_Tun1 in 172.64.240.253 -> 172.68.9.214: icmp: echo reply相反，传入 Tunnel 02/02 的流量应该从相同的隧道流出：
fortigate # diagnose sniffer packet any 'host 172.64.240.254' 4
interfaces=[any]
filters=[host 172.64.240.254]
0.912041 MWAN_IPsec_Tun2 in 172.64.240.254 -> 172.70.177.56: icmp: echo reply
0.912057 MWAN_IPsec_Tun2 out 172.64.240.254 -> 172.70.177.56: icmp: echo reply
0.913579 MWAN_IPsec_Tun2 in 172.64.240.254 -> 172.70.221.154: icmp: echo reply
0.913592 MWAN_IPsec_Tun2 out 172.64.240.254 -> 172.70.221.154: icmp: echo reply
0.914247 MWAN_IPsec_Tun2 in 172.64.240.254 -> 162.158.1.85: icmp: echo reply
0.914260 MWAN_IPsec_Tun2 out 172.64.240.254 -> 162.158.1.85: icmp: echo reply
0.918533 MWAN_IPsec_Tun2 in 172.64.240.254 -> 172.71.125.75: icmp: echo reply
0.918550 MWAN_IPsec_Tun2 out 172.64.240.254 -> 172.71.125.75: icmp: echo reply
0.924465 MWAN_IPsec_Tun2 in 172.64.240.254 -> 172.69.21.134: icmp: echo reply流调试有助于确定流量是否通过预期路径流入/流出防火墙。它比上一节中的抓包捕获提供更多细节，但会产生大量日志，因此仅应在绝对必要时启用。
此外，客户可能需要联系 Fortinet 技术支持以获取有关解释流调试日志的帮助，并获取有关如何配置 FortiGate 以确保根据应用要求正确路由流的建议。
fortigate # diagnose debug disable
fortigate # diagnose debug flow filter clear
fortigate # diagnose debug reset
fortigate # diagnose debug flow filter addr 172.64.240.253
fortigate # diagnose debug show flow show function-name enable
fortigate # diagnose debug config-error-log timestamps enable
fortigate # diagnose debug flow trace start 999
fortigate # diagnose debug enable
fortigate # 2023-08-01 09:27:26 id=20085 trace_id=2871 func=print_pkt_detail line=5844 msg="vd-root:0 received a packet(proto=1, 172.64.240.253:56968->172.70.121.28:0) tun_id=162.159.67.210 from MWAN_IPsec_Tun1. type=0, code=0, id=56968, seq=0."
2023-08-01 09:27:26 id=20085 trace_id=2871 func=rpdb_srv_match_input line=1036 msg="Match policy routing id=1: to 10.252.2.90 via ifindex-34"
2023-08-01 09:27:26 id=20085 trace_id=2871 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-162.159.67.210 via MWAN_IPsec_Tun1"
2023-08-01 09:27:26 id=20085 trace_id=2871 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface MWAN_IPsec_Tun1, tun_id=0.0.0.0"
2023-08-01 09:27:26 id=20085 trace_id=2871 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel MWAN_IPsec_Tun1"
2023-08-01 09:27:26 id=20085 trace_id=2871 func=esp_output4 line=844 msg="IPsec encrypt/auth"
2023-08-01 09:27:26 id=20085 trace_id=2871 func=ipsec_output_finish line=544 msg="send to 172.71.91.34 via intf-wan1"
2023-08-01 09:27:26 id=20085 trace_id=2872 func=print_pkt_detail line=5844 msg="vd-root:0 received a packet(proto=1, 172.64.240.253:18685->162.158.209.64:0) tun_id=162.159.67.210 from MWAN_IPsec_Tun1. type=0, code=0, id=18685, seq=0."
2023-08-01 09:27:26 id=20085 trace_id=2872 func=rpdb_srv_match_input line=1036 msg="Match policy routing id=1: to 10.252.2.90 via ifindex-34"
2023-08-01 09:27:26 id=20085 trace_id=2872 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-162.159.67.210 via MWAN_IPsec_Tun1"
2023-08-01 09:27:26 id=20085 trace_id=2872 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface MWAN_IPsec_Tun1, tun_id=0.0.0.0"
2023-08-01 09:27:26 id=20085 trace_id=2872 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel MWAN_IPsec_Tun1"
2023-08-01 09:27:26 id=20085 trace_id=2872 func=esp_output4 line=844 msg="IPsec encrypt/auth"
2023-08-01 09:27:26 id=20085 trace_id=2872 func=ipsec_output_finish line=544 msg="send to 172.71.91.34 via intf-wan1"通常使用 CTRL + C 并不能停止流调试。
您只需在调试日志滚动时的任何时候输入以下内容即可禁用流调试：
fortigate # diagnose debug disable