A site-to-site VPN lets two office locations communicate securely over the internet as if they were on the same local network. This walks through the core configuration steps for an IPsec tunnel between two FortiGate devices.
Before You Begin
Confirm both sides have a static public IP (or a reliable dynamic DNS setup) — site-to-site IPsec tunnels need a consistent address to establish reliably.
Step 1 — Create the IPsec tunnel (Site A)
Set the remote IP and pre-shared key
Enter Site B’s public IP address and a strong pre-shared key (share this securely, not over plain email).
Define local/remote subnets
Specify Site A’s local subnet and Site B’s remote subnet so the tunnel knows which traffic to encrypt.
Step 2 — Mirror the configuration on Site B
Repeat the wizard on Site B
Same process, with Site A’s public IP as the remote address and the identical pre-shared key.
Confirm matching Phase 1/Phase 2 settings
Encryption, authentication, and DH group settings must match exactly on both sides or the tunnel will fail to negotiate.
Step 3 — Create firewall policies
Allow traffic in both directions
Policy & Objects → Firewall Policy — create a policy from the local LAN to the VPN interface, and one from the VPN interface back to the local LAN.
Step 4 — Verify the tunnel
Test connectivity
Ping a device on the remote subnet from a device on the local subnet to confirm end-to-end connectivity.
Phase 1 and Phase 2 encryption/authentication settings must match exactly between both FortiGate devices — a single mismatched setting (e.g. DH group) is the most common reason a tunnel fails to come up.
Document the tunnel’s pre-shared key, subnets, and Phase 1/2 settings somewhere secure immediately after setup — you’ll need this reference the next time the tunnel needs troubleshooting.
Frequently Asked Questions
Can I use this same process for a non-FortiGate remote device?
Yes, IPsec is a standard protocol — select “Custom” instead of “FortiGate” in the wizard and match the Phase 1/2 parameters to the other vendor’s configuration.
Conclusion
A working site-to-site VPN comes down to matching Phase 1/Phase 2 settings exactly on both ends and remembering the firewall policies that actually permit traffic through the tunnel — the wizard handles most of the complexity if those two things are right.
Related Articles
