Configure interfaces and assign them to security zones.The function of these commands is similar to the ACL configuration on the HUAWEI firewall. ACLs are configured on the HUAWEI firewall to define protected data flows, and the dst-subnet and src-subnet command are run on the Fortinet firewall to define protected data flows. Protected data flows defined in HUAWEI and Fortinet firewalls must be mirrored.You must set the IKE version, encapsulation mode, and security protocol of the HUAWEI firewall to be the same as those on the Fortinet firewall. The default IKE version is IKEv1, encapsulation mode is tunnel mode, and security protocol is ESP. The Fortinet firewall does not provide the commands for setting the IKE version, encapsulation mode, and security protocol.You must set the connection parameters as specified in the data planning table to ensure that the parameters at the two ends are the same. The key to IPSec connection is that the connection parameters of the two parties must be completely the same.Configure the default route to the Internet.Configure a route to divert traffic to the tunnel interface.Configure a security policy to allow IKE negotiation packets, original IPSec packets, and decapsulated IPSec packets to pass through the Fortinet firewall.Assign the tunnel interface to the Untrust zone.

Apply the IPSec policy to an interface.

Configure an IPSec policy, including defining the data flow to be protected, configuring an IPSec proposal, creating an IKE proposal, and configuring an IKE peer.

Configure the default route from the HUAWEI firewall to the Internet.

Configure an interzone security policy to allow IKE negotiation packets, original IPSec packets, and decapsulated IPSec packets to pass through the HUAWEI firewall.Set IP addresses for interfaces and assign the interfaces to security zones.

Fortigate ipsec vpn