The third party will configure their VPN device with the public key and certificate you provided. They will also configure the IPsec settings to match the ones you configured on your VPN server.

Regularly monitor the VPN connection and maintain the certificates. Ensure that certificates are renewed before they expire to avoid service interruptions.

There are several steps involved in setting up an IPsec VPN using a FortiGate firewall and an RSA-signed certificate. First, make sure the third-party device and the FortiGate both have a current RSA-signed certificate. Next, set up the VPN settings on both ends, choosing the RSA-signed certificate for authentication and indicating that the authentication method is certificate-based.

With an RSA-signed certificate, you can create an IPSEC VPN with a non-affiliated device. On the other hand, you must confirm that your device has the VPN capability and that you own the required licenses.

Create a public and private key pair for the VPN server using RSA. Usually, the device serving as the VPN server is used for this.

Using the public key that was created in the previous step, create a CSR. A Certificate Authority (CA) will receive the CSR and sign it. The VPN server will use the signed certificate to authenticate itself.

here are some general guidelines on establishing an IPSEC VPN with a third party using RSA-signed certificates:

1. Prerequisites:

    Certificate Authority (CA): Obtain a valid RSA-signed certificate from a trusted CA for each VPN endpoint.
    VPN Devices: Ensure both VPN devices support IPSEC and certificate-based authentication.
    Network Connectivity: Verify basic network connectivity between the endpoints.

2. Certificate Installation:

    Import Certificates: Install the acquired certificates on their respective VPN devices, including:
        Public certificates of the remote endpoint(s).
        Your own private key and certificate.
    Trust Settings: Establish trust relationships between the endpoints by validating the CA signatures on the certificates.

3. IKE Phase 1 Configuration:

    Authentication Method: Select "Certificate" or "RSA signatures" for authentication.
    Encryption and Hash Algorithms: Choose appropriate algorithms (e.g., AES-256 for encryption, SHA-256 for hashing).
    DH Group: Select a Diffie-Hellman group for key exchange (e.g., Group 14, Group 20).

4. IKE Phase 2 Configuration:

    Protocol: Select ESP (Encapsulating Security Payload) for data encryption and authentication.
    Encryption and Authentication Algorithms: Choose algorithms matching those used in Phase 1.
    Perfect Forward Secrecy (PFS): Consider enabling PFS for enhanced security.

5. IPSec Tunnel Configuration:

    Local and Remote Networks: Specify the IP addresses or subnets to be protected by the VPN tunnel.
    Traffic Selectors: Define the traffic to be encrypted and sent through the tunnel.

6. Peer Configuration:

    IP Address or Hostname: Enter the IP address or hostname of the remote VPN endpoint.
    Certificate: Associate the remote endpoint's public certificate with the peer configuration.

7. Firewall Rules:

    Allow IKE and ESP Traffic: Ensure firewall rules permit IKE (UDP port 500) and ESP (IP protocol 50) traffic between the VPN endpoints.

8. Testing and Troubleshooting:

    Bring Up the Tunnel: Initiate the VPN connection from one or both endpoints.
    Verification: Use tools like ping, traceroute, or VPN-specific diagnostics to verify tunnel establishment and traffic flow.
    Troubleshooting: Consult device logs and documentation if issues arise.

Additional Considerations:

    Vendor-Specific Instructions: Refer to the documentation for your specific VPN devices for detailed configuration steps.
    Certificate Management: Implement proper certificate management practices for renewal and revocation.
    Security Best Practices: Adhere to security best practices for VPN configuration and maintenance.

Create a CSR using the public key generated in the previous step.

Please note that configuring an IPsec VPN with Fortigate is similar to Sangfor VPN Configuration (https://community.sangfor.com/pl ... ewdatabase&tid=1004). If you are using an RSA-Signed Certificate, you need to navigate to Network > IPsec > Certificate > CSR to generate a CSR request file. Then, generate a certificate based on the CSR and import it to IPsec > Certificate > Certificate. Additionally, import the peer certificate to the Certificate section as well.