Tools

Firewall Multivendor Configurator

Build a site-to-site IPsec VPN between two sites: drag a firewall to each site, enter the public IPs and LANs, and click Deploy to generate the configuration for each side — each end can use a different vendor. Use Deploy Terraform to generate the same configuration as a Terraform project.

Drag a firewall onto a site (or tap the firewall and then the site). The WAN and LAN interface names are optional: if left empty, the vendor default is used.

Site A

ISP A Public IP (WAN) ISP gateway Firewall WAN interface

Firewall A
Drop the firewall here

LAN A Firewall LAN IP Firewall LAN interface

Internet IPsec IKEv2

Site B

ISP B Public IP (WAN) ISP gateway Firewall WAN interface

Firewall B
Drop the firewall here

LAN B Firewall LAN IP Firewall LAN interface

Pre-shared key (PSK)

IKEv2 · AES-256-GCM · PRF SHA-384 · ECDH P-384 (DH 20) · PFS — CNSA suite, the strongest supported by all four vendors (FortiOS 6.2+, PAN-OS 10.0+, Junos 15.1X49+, ASA 9.0+).

Site A

Site B

How to apply the configuration with Terraform

Prerequisites. Terraform 1.5 or later installed (terraform version) and management access to each firewall from the machine running Terraform: HTTPS API on FortiGate and Palo Alto, SSH/NETCONF on the SRX.

API credentials, created once on each firewall:

Vendor	Credential	Variables
FortiGate	Token of a REST API Admin (System › Administrators › Create New › REST API Admin), with the Terraform machine IP in Trusted Hosts.	`TF_VAR_fortigate_host` `TF_VAR_fortigate_token`
Palo Alto	API key generated with `curl -k "https://<firewall>/api/?type=keygen&user=<user>&password=<password>"` (value of the `<key>` tag).	`TF_VAR_panos_host` `TF_VAR_panos_api_key`
Juniper SRX	User with configuration rights and NETCONF enabled: `set system services netconf ssh` + `commit`.	`TF_VAR_junos_host` `TF_VAR_junos_username` `TF_VAR_junos_password`

One folder per site. Click Copy Site A configuration and save it as main.tf in its own folder; repeat for Site B in another folder.
```
mkdir -p vpn/site-a vpn/site-b
cd vpn/site-a
# paste the Site A configuration into main.tf
```
Provide the credentials as environment variables (they stay out of files). FortiGate example — use the names from the table above for the other vendors:
```
# Linux / macOS
export TF_VAR_fortigate_host="192.0.2.10"
export TF_VAR_fortigate_token="<token>"

# Windows (PowerShell)
$env:TF_VAR_fortigate_host = "192.0.2.10"
$env:TF_VAR_fortigate_token = "<token>"
```
The PSK comes as the default value of vpn_psk; to keep it out of the file, delete the default line and set TF_VAR_vpn_psk to the same value on both sites.
Initialize, validate and review the plan. init downloads the provider; plan shows everything that will be created without touching the firewall.
```
terraform init
terraform fmt
terraform validate
terraform plan -out=site-a.tfplan
```
Apply.
```
terraform apply site-a.tfplan
```
On FortiGate changes take effect immediately; on the SRX the provider commits after each change; on Palo Alto you must commit after apply (Commit button in the web UI or configure → commit in the CLI).

Repeat steps 3 to 6 in the Site B folder and check that the tunnel is up:

# FortiGate
get vpn ipsec tunnel summary
diagnose vpn ike gateway list

# Palo Alto
show vpn ike-sa
show vpn ipsec-sa

# Juniper SRX
show security ike security-associations
show security ipsec security-associations

Caveats. The terraform.tfstate file stores the PSK and other secrets in plain text: do not publish it or commit it to Git (use an encrypted remote backend in production). To undo everything, terraform destroy removes the created objects — review the plan before confirming.