ipsec vpn site to site using digital certificate

Hello,

this question led to a small learning session with our apprentice this morning, which give us the diagram I am copying here for better understanding of that setup:

When using certificates in a VPN Site-to-Site configuration, you always need BOTH certificates on BOTH sides to verify you are talking to the right partner.

And of course you need them to be trusted by your firewall system.

So the main task when seeting this up is "How do I transfer the certificates from one site to the other" ?

thanks  my friend 

i will test your solution 

Forgot to say:

at the Sophos device "Remote certificate" has to be the certificate of the Fortigate device.

At the other side (the Fortigate screenshot) point "2." you have to put the Sophos certificate after importing it to the Fortigate.

ok

as shown in the diagram

from two sites:1- generate Generate Self Signed Certificate, 2- download default (root certificate)

Sophos site: use FortiGate branch certificate as local certificate, use FortiGate root certificate as remote certificate

FortiGate site: use Sophos root certificate in step 1 (certificate name), use Sophos self-signed certificate

in step 2  (peer certificate)

is it true?

thank you

No, you completely mixed it up:

Sophos side:

S-1. You use your locally generated certificate FROM THE SOPHOS itself as "local certificate".

S-2. You export the fortigate client certificate (you call it "branch certificate") ON THE FORTIGATE.

S-3. You export the Fortigate signing CA certificate that was used to sign the "branch certificate" on the FORTIGATE as above.

S-4. You then transfer both certs from the Fortigate-Site to the Sophos-Site. (use the .PEM format)

S-5. In Sophos-Menu "System/Certificates" you import the Fortigate CA cert into the Sophos as "Certificate Authorities (CA)". This is mandatory for the client certificate of the Fortigate to become a "trusted" certificate.

S-6. Now you import the Fortigate client certificate ("your branch cert") into the Sophos as a normal "Certificate"

S-7. Now you use the Fortigate client certificate (from step S-6) as the "remote certificate" in your VPN-configuration..

Fortigate side:

F-1. You use the SAME Fortigate client certificate (your "branch certificate" as the "local certificate" (here called "Signature" in the VPN coniguration)

F-2. You export the "Sophos VPN signing CA" and the Sophos client certificate you used as "local certificate" in step S-1.

F-3. You then transfer both certs from the Sophos-Site to the Fortigate-Site. (use the .PEM format, as before)

F-4. In Fortigate-Menu "System/Certificates" you first import the "Sophos VPN signing CA-cert" as a "CA-Certificate". Note that you cannot give the certs a name, it's automaticalle named "CA_Cert_1" by the Fortigate.

F-5. Then you import the Sophos client certificate as "Remote Certificate", this gets the name "Remote_Cert_1"

F-6. You now can use this Sophos client "Remote_Cert_1" as your "Peer certificate" in the VPN configuration of the Fortigate (Screenshot point 2.)

Hope this clarifies things.

Hi Sir

is it possible if the Fortigate will issue the certificate for both sides.

if it is ok

what must we do 

Every Sophos already HAS a least one certificate, so why do you want to do that?

But to answer your question: yes, you could use any certificate, that you want.