--- title: "Connect two firewalls with an IPsec VPN" description: "Join two E2E Firewalls with a site-to-site IPsec VPN tunnel from the FortiGate template, so the VPCs behind them reach each other privately." content_type: "how-to" product: "firewall" platform: "MyAccount" url: "/myaccount/firewall/how-to/connect-two-firewalls-with-an-ipsec-vpn/" topic: ["network"] --- # Connect two firewalls with an IPsec VPN Join two E2E Firewalls with a site-to-site IPsec VPN tunnel. The VPC behind each one then reaches the VPC behind the other on private addresses. You build the tunnel with the FortiGate's site-to-site template on each firewall in turn. The firewall you set up first is the local firewall, and the other one is the remote firewall. ## Before you begin You need: - Two E2E Firewalls with the status **Running**, each in its own VPC. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/). - The public IP of each firewall and the address range of each VPC. Each VPC needs its own address range, with no addresses shared between them. See [VPC](/myaccount/vpc/). ## Example values | Placeholder | What goes there | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | `` | The public IP of the firewall you are setting up, such as `203.0.113.10`. It is under **Public IP** on **Manage Firewall**. | | `` | The public IP of the other firewall, such as `203.0.113.20`. | | `` | The address range of the VPC behind the firewall you are setting up. It is under **CIDR** on **Manage Virtual Private Cloud**. | | `` | The address range of the VPC behind the other firewall. | | `` | A long random key that you make up, such as one from a password manager. Both firewalls use the same key. Keep it somewhere safe. | ## Sign in to the local firewall 1. In a browser, go to `https://`. 2. Sign in with the username `admin` and the password from the launch email E2E sent when the firewall first ran. For more on the first sign-in, see [Sign in to the FortiGate](/myaccount/firewall/how-to/sign-in-to-the-fortigate/). ## Move the FortiGate's screen to port 444 The tunnel uses port 443, the same port as the FortiGate's screen, so the screen can stop opening once the tunnel is in place. Move the screen to port 444 before you build the tunnel. 1. Open the FortiGate's command line: on the screen, or over SSH: ```bash ssh admin@ ``` 2. Run these commands to move the screen to port 444: ```text config system global set admin-sport 444 end ``` 3. Open the screen at its new address, `https://:444`, such as `https://203.0.113.10:444`, and sign in again. If neither the screen nor SSH opens, ask support to turn on console access, giving the firewall's name. The account owner can then choose **Access Console** from the firewall's **Actions** menu. You can also change the port on the screen instead of its command line. See [Move the FortiGate's screen to port 444](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-google-cloud/#move-the-fortigates-screen-to-port-444). ## Create the tunnel from the template 1. On the FortiGate's screen, go to **VPN** > **VPN Tunnels**, and click **Create new**. 2. Select **IPsec tunnel from template**. 3. In **Tunnel name**, enter a name for the tunnel, such as `vpc peering`. 4. Under **Select a template**, keep **Site to Site** selected. 5. Click **Begin**. The VPN wizard opens. ### Enter the pre-shared key Under **VPN tunnel**: 1. Keep **Authentication method** set to **Pre-shared key**. 2. In **Pre-shared key**, enter ``. Use the same key on both firewalls. 3. Click **Next**. ### Describe the remote firewall Under **Remote site**: 1. For **Remote site device type**, keep the FortiGate selected. 2. For **Remote site device**, keep **Accessible and static**. 3. In **IP/FQDN**, enter the remote firewall's public IP, ``. 4. Leave **Route this device's internet traffic through the remote site.** turned off. 5. In **Remote site subnets that can access VPN**, enter the remote VPC's range, ``. 6. Click **Next**. ### Choose the interfaces Under **Local site**: 1. Set **Outgoing interface that binds to tunnel** to **port1**, the FortiGate's internet side. 2. Leave **Create and add interface to zone** turned on. 3. Set **Local interface** to **port2**, the FortiGate's side in your VPC. 4. In **Local subnets that can access VPN**, check that your VPC's range, ``, is listed. 5. Leave **Allow remote site's internet traffic through this device** turned off. 6. Click **Next**. ### Review and submit The **Review** page lists what the wizard creates for the tunnel: - A local and a remote address group, with their addresses. - The IPsec Phase 1 and Phase 2 interfaces, and a zone, a named group that holds the tunnel's interface so the policies can use it. - A local-to-remote policy and a remote-to-local policy. - A destination route and a blackhole route to the remote network. ![The VPN wizard's Review page, listing the addresses, interfaces, zone, policies, and routes it will create, with a 500: Internal Server Error message in the corner.](/images/myaccount/firewall/fortigate-vpn-wizard-review.png) 1. Click **Submit**. 2. If **500: Internal Server Error** shows, ignore it and click **Submit** again. The wizard creates the tunnel and the items it listed. ## Check the policies on the local firewall Open the list of firewall policies. It shows the two policies the wizard added: one from **port2** to the tunnel's zone, and one from the tunnel's zone to **port2**. ![The firewall policy list, with one policy from port2 to the tunnel's zone and one from the tunnel's zone to port2.](/images/myaccount/firewall/fortigate-vpn-policies.png) ## Set up the remote firewall Repeat these steps on the remote firewall, from the sign-in to the policy check, with the two sides swapped: - Sign in at `https://`. - Move its screen to port 444 before you build its tunnel, then sign in again at `https://:444`. - In **IP/FQDN**, enter the first firewall's public IP, ``. - In **Remote site subnets that can access VPN**, enter the first firewall's VPC range, ``. - Use the same ``. - Check that its two firewall policies have been added. ## Check the tunnel 1. On each firewall, go to **VPN** > **VPN Tunnels**. The tunnel shows as up on both. 2. On each firewall, open the firewall policies and check that the two policies for the tunnel are there. The two VPCs are now joined by an IPsec tunnel between their firewalls. For a node to use it, add a route on the node to its firewall's private IP. See [Send a node's traffic through the firewall](/myaccount/firewall/how-to/sign-in-to-the-fortigate/#send-a-nodes-traffic-through-the-firewall). For help with a tunnel that shows as down on either side, see [The site-to-site VPN tunnel does not come up](/myaccount/firewall/troubleshooting/firewall/#the-site-to-site-vpn-tunnel-does-not-come-up).