ipsec vpn site to site using digital certificate

Question

hello 
 site (a) :headquarters (HQ) fortigate 
 site (B) branch office (BO) sophos xg 430 latest update 
 
 i built vpn site to site using a preshared key between two sites and work fine 
 but when change authentication type to digital certificate tunnel goes down 
 whats should i do to solve the certificate problem? 
 hint: i upload root and intermediate certificates to certificate authorities , then upload FortiGate branch office certificate to certificate and choose FortiGate branch office as local certificate and FortiGate root certificate as a remote certificate . 
 any help about cert files and should i use ? 
 should i sent sophos certificate to fortigate ? 
 thanks alot

PhilippRusch · Accepted Answer

Hello, 
 this question led to a small learning session with our apprentice this morning, which give us the diagram I am copying here for better understanding of that setup: 
 
 When using certificates in a VPN Site-to-Site configuration, you always need BOTH certificates on BOTH sides to verify you are talking to the right partner. 
 And of course you need them to be trusted by your firewall system. 
 
 So the main task when seeting this up is "How do I transfer the certificates from one site to the other" ?

PhilippRusch · Answer

No, you completely mixed it up: 
 Sophos side: 
 S-1. You use your locally generated certificate FROM THE SOPHOS itself as "local certificate". 
 S-2. You export the fortigate client certificate (you call it "branch certificate") ON THE FORTIGATE. 
 S-3. You export the Fortigate signing CA certificate that was used to sign the "branch certificate" on the FORTIGATE as above. 
 S-4. You then transfer both certs from the Fortigate-Site to the Sophos-Site. (use the .PEM format) 
 S-5. In Sophos-Menu "System/Certificates" you import the Fortigate CA cert into the Sophos as "Certificate Authorities (CA)". This is mandatory for the client certificate of the Fortigate to become a "trusted" certificate. 
 S-6. Now you import the Fortigate client certificate ("your branch cert") into the Sophos as a normal "Certificate" 
 S-7. Now you use the Fortigate client certificate (from step S-6) as the "remote certificate" in your VPN-configuration.. 
 
 Fortigate side: F-1. You use the SAME Fortigate client certificate (your "branch certificate" as the "local certificate" (here called "Signature" in the VPN coniguration) 
 F-2. You export the "Sophos VPN signing CA" and the Sophos client certificate you used as "local certificate" in step S-1. 
 F-3. You then transfer both certs from the Sophos-Site to the Fortigate-Site. (use the .PEM format, as before) 
 F-4. In Fortigate-Menu "System/Certificates" you first import the "Sophos VPN signing CA-cert" as a "CA-Certificate". Note that you cannot give the certs a name, it's automaticalle named "CA_Cert_1" by the Fortigate. 
 F-5. Then you import the Sophos client certificate as "Remote Certificate", this gets the name "Remote_Cert_1" 
 F-6. You now can use this Sophos client "Remote_Cert_1" as your "Peer certificate" in the VPN configuration of the Fortigate (Screenshot point 2.) 
 
 Hope this clarifies things.

ipsec vpn site to site using digital certificate

Top Replies