Technical Tip: Connecting FortiManager to FortiGate over a VPN 3G ISP line
Description
This article explains how to connect FortiManager to FortiGate over a VPN 3G ISP line.
Scope
FortiGate.
Solution
For this setup, the following is required:
config system central-management
set fmg "IP address of the FortiManager"
set fmg-source-ip <IP of the VPN interface or Internal interface of the FortiGate>
end
set fmg "IP address of the FortiManager"
set fmg-source-ip <IP of the VPN interface or Internal interface of the FortiGate>
end
On the policies that are meant for VPN ,the following must be set:
config firewall policy
edit <VPN policy ID>
set tcp-mss-sender 1300
set tcp-mss-receiver 1300
end
edit <VPN policy ID>
set tcp-mss-sender 1300
set tcp-mss-receiver 1300
end
If the FortiGate is behind another NAT device then these changes must be done on that unit as well. The following packet capture can be used to ensure MSS is matching on all ends:
On both FortiGates:
diagnose debug disable
diagnose debug reset
diagnose debug application fgfmd -1
diagnose debug enable
diagnose sniffer packet <VPN interface name> "port 541" 3
diagnose sniffer packet <VPN interface name> "port 541" 3
This output can be converted to Wireshark.
On the FortiManager:
diagnose debug disable
diagnose debug reset
diagnose debug application fgfmsd -1
diagnose debug enable
diagnose sniffer packet any "host <Ip of the remote FortiGate> and port 541" 3
diagnose debug enable
diagnose sniffer packet any "host <Ip of the remote FortiGate> and port 541" 3
This output can be converted to Wireshark.
To stop the debug processes in the end on both FortiGate and FortiManager, press 'Ctrl+C' and enter 'diagnose debug disable', 'diagnose debug reset'.
