! PermitANY — Fortinet FortiGate Site-to-Site IPSec VPN
! IKEv2 site-to-site IPSec VPN for FortiGate: phase1/phase2 proposals, tunnel interface, static route, and firewall policy for VPN traffic.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
# FortiGate Site-to-Site IPSec VPN — FGT-HQ-01
!
config vpn ipsec phase1-interface
    edit "VPN-HQ-to-BRANCH"
        set type static
        set interface "port1"
        set ike-version 2
        set remote-gw 203.0.113.2
        set psksecret MyVPNKey2024!
        set proposal aes256-sha512
        set dhgrp 20
        set dpd on-idle
        set dpd-retryinterval 10
        set keylife 86400
        set nattraversal enable
    next
end
!
config vpn ipsec phase2-interface
    edit "VPN-HQ-to-BRANCH-P2"
        set phase1name "VPN-HQ-to-BRANCH"
        set proposal aes256gcm-sha256
{{#unless (eq p2_pfs "none")}}
        set pfs enable
        set dhgrp 20
{{/unless}}
        set src-subnet 192.168.1.0/24
        set dst-subnet 10.0.0.0/24
        set keylife 3600
        set keylifetype seconds
        set replay enable
    next
end
!
config system interface
    edit "VPN-HQ-to-BRANCH"
        set type tunnel
        set ip 169.254.0.1 255.255.255.255
        set remote-ip 169.254.0.2 255.255.255.255
        set interface "port1"
    next
end
!
config router static
    edit 0
        set dst 10.0.0.0/24
        set device "VPN-HQ-to-BRANCH"
    next
end
!
config firewall policy
    edit 0
        set name "VPN-VPN-HQ-to-BRANCH-in"
        set srcintf "VPN-HQ-to-BRANCH"
        set dstintf "internal"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule always
        set service ALL
        set logtraffic all
    next
    edit 0
        set name "VPN-VPN-HQ-to-BRANCH-out"
        set srcintf "internal"
        set dstintf "VPN-HQ-to-BRANCH"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule always
        set service ALL
        set logtraffic all
    next
end