! ── Create VLANs ──────────────────────────────────────────
vlan 10
 name Servers
vlan 20
 name Management
vlan 30
 name Users
vlan 40
 name IoT
vlan 999
 name Unused-Native
!
! ── Disable VLAN 1 — security hardening ──────────────────
interface Vlan1
 no ip address
 shutdown
!
! ── Trunk to FortiGate — allow only named VLANs ──────────
interface GigabitEthernet0/1
 description Uplink_to_FortiGate_LAG
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40
 switchport trunk native vlan 999
 no shutdown
!
! ── Access port — server on VLAN 10 ─────────────────────
interface GigabitEthernet0/10
 description Proxmox_Node_1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!
! ── L3 SVI — inter-VLAN routing on Cisco ────────────────
interface Vlan10
 ip address 10.0.10.2 255.255.255.0
 no shutdown
!
! ── Verify ───────────────────────────────────────────────
show vlan brief
show interfaces trunk

! ── Create the logical Port-Channel interface first ──────
interface Port-channel1
 description LAG_to_FortiGate
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40
 switchport trunk native vlan 999
!
! ── Assign physical members — active mode initiates LACP ─
interface GigabitEthernet0/1
 description LAG_link1_to_FortiGate
 channel-group 1 mode active
 no shutdown

interface GigabitEthernet0/2
 description LAG_link2_to_FortiGate
 channel-group 1 mode active
 no shutdown
!
! ── Verify ───────────────────────────────────────────────
show etherchannel summary
show lacp neighbor
show interfaces port-channel 1 status

! ── Enable RSTP globally ──────────────────────────────────
spanning-tree mode rapid-pvst

! ── Set Cisco as root for all VLANs (priority 4096) ──────
! Default priority is 32768 — lower wins the election
spanning-tree vlan 10,20,30,40 priority 4096

! ── Edge ports — skip 30s listening/learning ────────────
! PortFast: use ONLY on ports connected to end devices
interface range GigabitEthernet0/10 - 24
 spanning-tree portfast
 ! BPDU Guard: shut port immediately if BPDU received
 ! Prevents rogue switch from joining topology
 spanning-tree bpduguard enable

! ── Enable BPDU Guard globally on all PortFast ports ─────
spanning-tree portfast bpduguard default

! ── Auto-recover from err-disable after 5 minutes ───────
errdisable recovery cause bpduguard
errdisable recovery interval 300

! ── Verify ───────────────────────────────────────────────
show spanning-tree vlan 10
show spanning-tree summary

# ── Enable OSPF on FortiGate ──────────────────────────────
config router ospf
  set router-id      10.0.20.1   # FortiGate loopback / mgmt IP
  set redistribute   connected     # share all connected networks
  set redistribute   static        # share default route 0.0.0.0/0 to internet
  config area
    edit 0.0.0.0                    # Area 0 — backbone
    next
  end
  config ospf-interface
    edit "ospf-to-cisco"
      set interface    "vlan20"     # mgmt VLAN — connects to Cisco SVI
      set area         0.0.0.0
      set network-type point-to-point
      set hello-interval  10
      set dead-interval   40
    next
  end
  config network
    edit 1
      set prefix   10.0.0.0 255.255.0.0  # advertise all VLANs
      set area     0.0.0.0
    next
  end
end

# ── Redistribute default route to Cisco ──────────────────
config router ospf
  set default-information-originate always
end

! ── Enable OSPF process on Cisco L3 switch ───────────────
router ospf 1
 router-id     10.0.20.2        ! Cisco SVI management IP
 passive-interface default        ! never send OSPF on access ports
 no passive-interface Vlan20       ! OSPF only on mgmt SVI toward FGT
 network 10.0.0.0 0.0.255.255 area 0  ! all SVIs in area 0
 default-information originate    ! accept default route from FortiGate
!
! ── OSPF on the uplink SVI to FortiGate ─────────────────
interface Vlan20
 ip ospf 1 area 0
 ip ospf network point-to-point
 ip ospf hello-interval 10
 ip ospf dead-interval  40
!
! ── Verify ───────────────────────────────────────────────
show ip ospf neighbor
show ip ospf database
show ip route ospf

# ── BGP configuration — FortiGate peering with ISP ───────
config router bgp
  set as          65001            # our private AS number
  set router-id   10.0.20.1      # FortiGate management IP

  config neighbor
        # ── ISP 1 peer (WAN1) ──────────────────────────────
    edit 203.0.113.1               # ISP 1 gateway IP
      set remote-as     64500      # ISP 1 public AS
      set interface     "wan1"
      set update-source "wan1"
            # LOCAL_PREF 200 = strongly prefer WAN1
      set route-map-in  "SET_LOCALPREF_WAN1"
      set keepalive-timer 60
      set holdtime-timer  180
    next
        # ── ISP 2 peer (WAN2 — backup) ─────────────────────
    edit 198.51.100.1              # ISP 2 gateway IP
      set remote-as     64501      # ISP 2 public AS
      set interface     "wan2"
      set update-source "wan2"
            # LOCAL_PREF 100 = use WAN2 only as backup
      set route-map-in  "SET_LOCALPREF_WAN2"
    next
  end

    # ── Route maps to set LOCAL_PREF per ISP ──────────────
  config route-map
    edit "SET_LOCALPREF_WAN1"
      config rule
        edit 1
          set set-local-preference 200
        next
      end
    next
    edit "SET_LOCALPREF_WAN2"
      config rule
        edit 1
          set set-local-preference 100
        next
      end
    next
  end
end

# ── Verify ────────────────────────────────────────────────
get router info bgp summary
get router info bgp neighbors
get router info routing-table bgp

# ── DHCP relay on Aruba access switch ─────────────────────
# When a device on VLAN 30 sends a DHCP broadcast,
# Aruba forwards it as unicast to FortiGate 10.0.30.1
interface vlan30
  ip address 10.0.30.2/24
  ip helper-address 10.0.30.1   # FortiGate as DHCP server
  no shutdown

interface vlan40
  ip address 10.0.40.2/24
  ip helper-address 10.0.40.1
  no shutdown

# ── Configure HA on FGT-A (primary) ──────────────────────
config system ha
  set mode          a-p              # active-passive
  set group-name    "homelab-cluster"
  set group-id      1
  set password      "HA-secret-key"  # must match on both units
  set priority      200             # higher = primary (FGT-A=200, FGT-B=100)
  set hbdev         "port4"  50    # heartbeat on port4, priority 50
  set session-sync-dev "port4"      # session table sync on same link
  set override      enable           # re-elect primary after failure recovery
  set monitor       "wan1" "port1"  # monitor these interfaces for failover trigger
end

# ── Same config on FGT-B but priority 100 ────────────────
# set priority 100

# ── Verify cluster status ─────────────────────────────────
get system ha status
diagnose sys ha status
diagnose sys ha checksum show   # config sync verification

! ── DHCP Snooping — per VLAN ─────────────────────────────
ip dhcp snooping
ip dhcp snooping vlan 10,30,40
no ip dhcp snooping information option   ! remove option 82 (causes issues)
!
! ── Trust only the uplink port to FortiGate ──────────────
interface Port-channel1
 ip dhcp snooping trust
!
! Access ports are untrusted by default — rogue DHCP blocked
!
! ── Dynamic ARP Inspection — per VLAN ───────────────────
ip arp inspection vlan 10,30,40
ip arp inspection validate src-mac dst-mac ip
!
! ── Trust the uplink for ARP too ─────────────────────────
interface Port-channel1
 ip arp inspection trust
!
! ── Verify ───────────────────────────────────────────────
show ip dhcp snooping binding
show ip arp inspection vlan 10

# ── Address objects — reused across all policies ─────────
config firewall address
  edit "VLAN10-Servers"
    set subnet 10.0.10.0 255.255.255.0
  next
  edit "VLAN20-Management"
    set subnet 10.0.20.0 255.255.255.0
  next
  edit "VLAN40-IoT"
    set subnet 10.0.40.0 255.255.255.0
  next
end

# ── VIP — inbound DNAT for Cloudflare Tunnel ─────────────
config firewall vip
  edit "VIP-Cloudflare"
    set extintf "wan1"
    set extip   0.0.0.0
    set mappedip "10.0.10.20-10.0.10.20"
    set portforward enable
    set protocol tcp
    set extport    443
    set mappedport 443
  next
end

# ── Deny IoT from reaching servers — logged ───────────────
config firewall policy
  edit 35
    set name      "IoT-block-Servers"
    set srcintf   "vlan40"
    set dstintf   "vlan10"
    set srcaddr   "VLAN40-IoT"
    set dstaddr   "VLAN10-Servers"
    set action    deny
    set schedule  "always"
    set service   "ALL"
    set logtraffic all
  next
end

! ── Template — apply to all access ports ────────────────
interface GigabitEthernet0/10
 description Server_Access_VLAN10
 switchport mode access
 switchport access vlan 10
 ! Port security — max 3 MACs, restrict + log violations
 switchport port-security maximum 3
 switchport port-security violation restrict
 switchport port-security
 ! PortFast — immediate forwarding (no STP delay)
 spanning-tree portfast
 ! BPDU Guard — shut if another switch connects
 spanning-tree bpduguard enable
 ! Storm control — max 10% broadcast, 10% multicast
 storm-control broadcast level 10.00
 storm-control multicast level 10.00
 storm-control action shutdown
 no shutdown
!
! Violation modes:
!  protect  = drop + no log, port stays up
!  restrict = drop + SNMP trap log, port stays up   ← used
!  shutdown = err-disable immediately (strictest)

# ── Enable FortiGate built-in DDNS (FortiDDNS) ───────────
# This registers a hostname: <serial>.fortiddns.com
config system ddns
  edit 1
    set ddns-server    FortiGuardDDNS
    set use-public-ip  enable
    set update-interval 300         # update every 5 minutes
    set monitor-interface "wan1"   # watch WAN interface for IP change
    set ddns-domain    "homelab.fortiddns.com"
  next
end

# ── Alternative: third-party DDNS provider (e.g. No-IP) ──
config system ddns
  edit 2
    set ddns-server    No-IP
    set ddns-username  "your-noip-username"
    set ddns-password  "your-noip-password"
    set ddns-domain    "homelab.ddns.net"
    set monitor-interface "wan1"
    set update-interval 300
  next
end

# ── Verify DDNS is updating correctly ─────────────────────
diagnose debug application ddnsd -1
diagnose debug enable
# Then check: current IP in DDNS record should match WAN IP
get system ddns

# ── Phase 1 — IKE negotiation ─────────────────────────────
# This defines HOW the tunnel is negotiated
config vpn ipsec phase1-interface
  edit "SiteB-VPN"
    set interface     "wan1"
    set ike-version   2
        # Remote peer — use DDNS hostname, not static IP
    set remote-gw-ddns "siteB.fortiddns.com"
        # Authentication with pre-shared key
    set authmethod    psk
    set psksecret     "YourStrongPreSharedKey!2024"
        # Encryption — AES-256-GCM is preferred for IKEv2
    set proposal      aes256gcm-prfsha384
    set dhgrp         20   # ECDH P-384
        # Dead Peer Detection — detect if tunnel drops
    set dpd           on-demand
    set dpd-retrycount 3
    set dpd-retryinterval 10
        # Local gateway ID = DDNS hostname of THIS FortiGate
    set localid       "homelab.fortiddns.com"
    set localid-type  fqdn
    set mode-cfg      disable
    set net-device    enable
  next
end

# ── Phase 2 — what traffic goes through the tunnel ────────
config vpn ipsec phase2-interface
  edit "SiteB-VPN-P2"
    set phase1name   "SiteB-VPN"
        # Traffic selectors — subnets on each side
    set src-subnet   10.0.10.0 255.255.255.0   # local LAN (homelab)
    set dst-subnet   192.168.1.0 255.255.255.0  # remote LAN (site B)
        # ESP encryption for data
    set proposal     aes256gcm
    set dhgrp        20
        # Rekey every 8 hours
    set keylifeseconds 28800
    set auto-negotiate enable
  next
end

# ── Static route — send remote subnet through tunnel ──────
config router static
  edit 10
    set dst       192.168.1.0 255.255.255.0
    set device    "SiteB-VPN"
    set comment   "Route to Site B through IPsec tunnel"
  next
end

# ── Firewall policy — allow traffic through tunnel ─────────
config firewall policy
  edit 60
    set name      "LAN-to-SiteB"
    set srcintf   "vlan10"
    set dstintf   "SiteB-VPN"
    set srcaddr   "VLAN10-Servers"
    set dstaddr   "SiteB-LAN"
    set action    accept
    set schedule  "always"
    set service   "ALL"
    set logtraffic all
  next
  edit 61
    set name      "SiteB-to-LAN"
    set srcintf   "SiteB-VPN"
    set dstintf   "vlan10"
    set srcaddr   "SiteB-LAN"
    set dstaddr   "VLAN10-Servers"
    set action    accept
    set schedule  "always"
    set service   "ALL"
    set logtraffic all
  next
end

# ── Check tunnel status ───────────────────────────────────
get vpn ipsec tunnel summary
get vpn ipsec tunnel details

# ── Check IKE SA (Phase 1) ────────────────────────────────
diagnose vpn ike status
diagnose vpn ike gateway list

# ── Check IPsec SA (Phase 2) ─────────────────────────────
diagnose vpn tunnel list

# ── Real-time debug (Phase 1 negotiation) ────────────────
diagnose debug application ike -1
diagnose debug enable
# Run the above, then bring tunnel up, check output
diagnose debug disable

# ── Ping through tunnel to verify routing ────────────────
execute ping-options source 10.0.10.1   # source from inside VLAN
execute ping 192.168.1.1                   # ping remote site B gateway

# ── Force tunnel re-negotiation ──────────────────────────
diagnose vpn ike restart

# ── Create WireGuard interface ────────────────────────────
config system wireguard
  edit "wg0"
    set listen-port   51820
    set private-key   "<FortiGate-private-key-base64>"
        # Assign IP from a dedicated WireGuard subnet
    config peers
      edit 1
        set name        "laptop-client"
        set public-key  "<client-public-key-base64>"
        set allowed-ips 10.0.50.2 255.255.255.255
      next
    end
  next
end

# ── Client config (wg0.conf on laptop) ───────────────────
# [Interface]
# PrivateKey = <client-private-key>
# Address    = 10.0.50.2/24
# DNS        = 10.0.40.1  # Pi-hole
#
# [Peer]
# PublicKey  = <FortiGate-public-key>
# Endpoint   = homelab.fortiddns.com:51820  # DDNS hostname
# AllowedIPs = 10.0.0.0/16  # route all homelab traffic
# PersistentKeepalive = 25