> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Transit Gateway to FortiGate Over the Internet Workflow
> This is not a common scenario. You would only set up this type of connection if you want to connect an Aviatrix Transit gateway to a firewall that is outside your Cloud service provider (for example, in a branch office or warehouse).
This is not a common scenario. You would only set up this type of connection
if you want to connect an Aviatrix Transit gateway to a firewall that is
outside your Cloud service provider (for example, in a branch office or
warehouse).
1. In CoPilot, navigate to Cloud Fabric > Gateways > Transit Gateways.
2. Create a Transit gateway
that will connect to your FortiGate firewall.
3. To connect the transit VPC gateway to FortiGate, navigate to Networking >
Connectivity > External Connections (S2C).
4. Click *+External Connection*.
5. In the Add External Connection dialog, configure the following:
| Field | Value |
| ----------------------- | ------------------------------------------------------------------------------------------------- |
| Connect Public Cloud to | External Device > BGP over IPsec |
| Local Gateway | Select the Transit gateway you created in step 2 above |
| Local ASN | The BGP AS number the Transit gateway will use to exchange routes with the external device. |
| Remote ASN | Enter the BGP AS number the external device will use to exchange routes with the Transit Gateway. |
| Remote Device IP | This is the FortiGate WAN IP. |
Ensure that the Local/Remote ASN and the Remote Device IP are correct before
saving.
6. Click *Save*.
7. [Download the configuration](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-download-configuration.html).
The following is a sample configuration based on the Site2Cloud configuration
above.
## Configuring the Fortinet FortiGate Firewall
1. Login into FortiGate and configure it as follows:
1. Navigate to VPN > IPsec Tunnels.
2. Click *+Create New*, and select *IPsec Tunnel*.
3. In the VPN Creation Wizard, select the Custom template type.
4. Populate the fields according to your preferences.
5. Click *Next*.
### VPN Setup
| Field | Expected Value |
| ------------- | -------------- |
| Name | Any name |
| Template Type | Custom |
### New VPN Tunnel Tab
2. Complete the Network fields on the New VPN Tunnel tab as follows:
**Network section of New VPN Tunnel tab**
| Field | Expected Value |
| ------------------- | ------------------------------------- |
| IP Version | IPv4 |
| Remote Gateway | Static IP Address |
| IP Address | Public IP address of Aviatrix Gateway |
| Interface | Select the external port/interface |
| Local Gateway | Disabled |
| Mode Config | Unchecked |
| NAT Traversal | Recommended: Enable |
| Keepalive Frequency | Any value |
| Dead Peer Detection | On Demand |
**Authentication section of New VPN Tunnel tab**
| Field | Expected Value |
| -------------- | -------------------------------------------------------------------------------------------------------------- |
| Method | Pre-Shared Key |
| Pre-shared Key | In the Pre-shared Key field, enter the value from the Pre-Shared Key row in the downloaded configuration file. |
| IKE Version | 1 |
| IKE Mode | Main (ID protection) |
**Phase 1 Proposal section of New VPN Tunnel tab**
| Field | Expected Value |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Encryption | In the Encryption field, enter the value from the Encryption Algorithm row in the downloaded configuration file. |
| Authentication | In the Authentication field, enter the value from the Authentication Algorithm row in the downloaded configuration file. |
| Diffie-Hellman Group | Select the appropriate value as per the Perfect Forward Secrecy row in the downloaded configuration file. |
| Key Lifetime (seconds) | 28800 |
| Local ID | |
**XAUTH section of New VPN Tunnel tab**
| Field | Expected Value |
| ----- | -------------- |
| Type | Disabled |
**Phase 2 Selectors > New Phase 2 section of New VPN Tunnel tab**
| Field | Expected Value |
| -------------- | ---------------- |
| Name | Any string value |
| Comments | Any string value |
| Local Address | 0.0.0.0/0 |
| Remote Address | 0.0.0.0/0 |
**Advanced section of New VPN Tunnel tab**
Click *+Advanced* to complete the fields listed below.
Obtain the following values from the downloaded configuration file.
| Field | Expected Value |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Encryption | In the Encryption field, enter the value from the Encryption Algorithm row in the downloaded configuration file. |
| Authentication | In the Authentication field, enter the value from the Authentication Algorithm row in the downloaded configuration file. |
| Diffie-Hellman Group | Select the appropriate value as per the Perfect Forward Secrecy row in the downloaded configuration file. |
| Key Lifetime (seconds) | 28800 |
3. Click *OK*.
4. Navigate to Network > Interfaces.
5. Click on the Tunnel created above (e.g. aviatrix-gatew) and assign the IP
address from the downloaded configuration file.
6. Click *OK*.
### Configure IPv4 Policy
1. Navigate to Policy & Objects > IPv4 DoS Policy.
2. Create two new IPv4 policies:
1. Outbound traffic
2. Inbound traffic
The reference to *port2* in the screenshots should be replaced with your own
interface name that represents the internal facing interface.
Be sure to select *ACCEPT* for Action and select *ALL* for Service.
### IPSec Monitor
1. In the Fortigate UI, navigate to Dashboard > Network and click the IPsec
widget.
2. Select the Aviatrix tunnel, and click *Bring Up*.
3. You can then check the tunnel status in CoPilot under Diagnostics > Cloud
Routes.
### BGP
1. In the FortiGate UI, navigate to Network > BGP.
2. Configure the Local BGP Options as below:
* RouterID: Tunnel IP address taken from the configuration file downloaded at
step3
* Neighbors: Remote tunnel IP address and ASN
* Networks: All the networks needs to be advertised via BGP (here 10.0.3.0 is
the local network of FortiGate)
3. In CoPilot, go to Diagnostics > Cloud Routes > BGP Info to verify the BGP
Routes. The Status should be Established. If some external connections for
the selected Transit Gateway are Not Established, the overall BGP Status for
the Transit Gateway is Partially Established.