# REFERENSI IPSEC SITE-TO-SITE TEMPLATE:

config vpn ipsec phase1-interface
 edit "HQ-BRANCH"
  set interface "port1"
  set ike-version 2
  set peertype any
  set remote-gw 198.51.100.2
  set proposal aes256-sha256
  set dhgrp 14
  set psksecret ENC CHANGE_ME
 next
end

config vpn ipsec phase2-interface
 edit "HQ-BRANCH-P2"
  set phase1name "HQ-BRANCH"
  set proposal aes256-sha256
  set src-subnet 192.168.10.0 255.255.255.0
  set dst-subnet 192.168.20.0 255.255.255.0
 next
end

config router static
 edit 0
  set dst 192.168.20.0 255.255.255.0
  set device "HQ-BRANCH"
 next
end

config firewall policy
 edit 0
  set name "HQ-to-Branch"
  set srcintf "port2"
  set dstintf "HQ-BRANCH"
  set srcaddr "all"
  set dstaddr "all"
  set action accept
  set schedule "always"
  set service "ALL"
  set nat disable
 next
end

# Terapkan kebalikan konfigurasinya di sisi cabang.
# Ganti PSK, proposal, dan subnet sesuai desain aktual Anda.


==================== FORTIGATE SSL-VPN REMOTE WORKER =====================
# ==============================================================
#  FORTINET FORTIGATE-100E  FortiOS v7.4.3 GA (Build 1823)
#  Tujuan: Remote Access SSL-VPN untuk Pekerja Remote
#  Port   : TCP 443 (HTTPS) + DTLS 1.2 UDP 443
#  Realm  : /remote-karyawan → SSO LDAP Azure AD Domain Services
# ==============================================================

# --- 1. Portal SSL-VPN (Full Tunnel + Split Tunnel) ---
config vpn ssl web portal
    edit "full-access-karyawan"
        set tunnel-mode enable
        set ip-pools "SSLVPN-POOL-10.200.50.0_24"
        set split-tunneling enable
        set split-tunneling-routing-address "LAN-KARYAWAN-172.16.0.0_24" "SERVER-FARM-10.0.20.0_24"
        set split-tunneling-routing-negate disable
        set dns-server1 10.0.20.10
        set dns-server2 10.0.20.11
        set default-gateway 10.200.50.1
        set host-check software av firewall os patch
        set limit 3
        set mac-addr-action allow
    next
    edit "guest-web-only"
        set web-mode enable
        set skip-check-referer enable
    next
end

# --- 2. Setting SSL-VPN Global ---
config vpn ssl settings
    set servercert "wildcard-devnetcuk-com-2026-ECC384"
    set req-client-cert disable
    set ssl-max-proto-ver tls1_3
    set ssl-min-proto-ver tls1_2
    set banned-cipher RC4 DES 3DES AES128 AES256-GCM-SHA384
    set idle-timeout 900
    set auth-timeout 28800
    set tunnel-ip-pools "SSLVPN-POOL-10.200.50.0_24"
    set tunnel-ipv6-pools "SSLVPNv6-ULA"
    set source-interface "port1-WAN-ISP1" "port2-WAN-ISP2"
    set source-address "all"
    set source-address6 "all"
    set default-portal "web-access"
    set dual-stack-mode prefer-ipv4
    set dtls-hello-timeout 10
    set dtls-tunnel enable
    set hsts-include-subdomains enable
    set hsts-max-age 31536000
    set x-content-type-options enable
    set x-frame-options deny
    set csp-header enable
    set cipher-suites TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-AES-128-GCM-SHA256
end

# --- 3. Users & Groups (LDAP Sync) ---
config user group
    edit "GRP-REMOTE-KARYAWAN"
        set member "azuread-sso-ldap"
    next
end

# --- 4. Firewall Policy: SSL-VPN → Internal ---
config firewall policy
    edit 77
        set name "SSL-VPN KARYAWAN → LAN KARYAWAN & SERVER FARM"
        set srcintf "ssl.root"
        set dstintf "internal1-lan" "internal3-serverfarm"
        set srcaddr "all"
        set dstaddr "LAN-KARYAWAN-172.16.0.0_24" "SERVER-FARM-10.0.20.0_24"
        set action accept
        set schedule "always"
        set service "ALL"
        set groups "GRP-REMOTE-KARYAWAN"
        set users "all"
        set fsso disable
        set nat disable
        set logtraffic all
        set comments "Audit trail enabled for SOX compliance"
    next
    edit 78
        set name "SSL-VPN KARYAWAN → Internet (split-tunnel exclude)"
        set srcintf "ssl.root"
        set dstintf "port1-WAN-ISP1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "HTTP HTTPS DNS QUIC_853 SSH"
        set groups "GRP-REMOTE-KARYAWAN"
        set nat enable
        set ippool enable
        set poolname "PAT-SNAT-POOL-ISP1"
        set logtraffic utm
        set utm-status enable
        set ssl-ssh-profile "certificate-inspection-2026"
        set av-profile "default-anti-ransomware"
        set webfilter-profile "strict-karyawan"
        set ips-sensor "Balanced_Security_and_Accuracy"
        set application-list "block-p2p-torrent"
    next
end

# --- 5. 2FA MFA TOTP ---
config user two-factor
    set status enable
    set mandatory enable
    set methods fortitoken-email fortitoken-mobile totp
end

# TOPOLOGY + IP PLAN:

<?xml version="1.0" encoding="UTF-8"?>
<lab version="1" revision="1">
  <topology>
    <nodes>
      <node id="1" name="FortiGate-HQ" type="qemu" image="fortigate-7.2" ram="2048" ethernet="2" left="180" top="140" />
      <node id="2" name="FortiGate-Branch" type="qemu" image="fortigate-7.2" ram="2048" ethernet="2" left="520" top="140" />
      <node id="3" name="Client-HQ" type="vpcs" image="vpcs" ram="128" ethernet="1" left="90" top="290" />
      <node id="4" name="Client-Branch" type="vpcs" image="vpcs" ram="128" ethernet="1" left="610" top="290" />
    </nodes>
    <networks>
      <network id="1" name="Internet" type="bridge" />
      <network id="2" name="LAN-HQ" type="bridge" />
      <network id="3" name="LAN-Branch" type="bridge" />
    </networks>
    <connections>
      <connection node="1" network="1" interface="0" />
      <connection node="2" network="1" interface="0" />
      <connection node="1" network="2" interface="1" />
      <connection node="3" network="2" interface="0" />
      <connection node="2" network="3" interface="1" />
      <connection node="4" network="3" interface="0" />
    </connections>
  </topology>
</lab>


segment,device,interface,ip_address,prefix,gateway,notes
WAN-HQ,FortiGate-HQ,port1,203.0.113.2,/30,203.0.113.1,IP publik kantor pusat
WAN-Branch,FortiGate-Branch,port1,198.51.100.2,/30,198.51.100.1,IP publik kantor cabang
LAN-HQ,FortiGate-HQ,port2,192.168.10.1,/24,-,Gateway user pusat
LAN-HQ,Client-HQ,eth0,192.168.10.10,/24,192.168.10.1,Host uji dari pusat
LAN-Branch,FortiGate-Branch,port2,192.168.20.1,/24,-,Gateway user cabang
LAN-Branch,Client-Branch,eth0,192.168.20.10,/24,192.168.20.1,Host uji dari cabang
Tunnel,HQ-BRANCH,phase2-selector,192.168.10.0<->192.168.20.0,/24,-,Selector traffic terenkripsi
