Skip to main content
jprokic
Staff
Staff
October 15, 2024

Technical Tip: IPsec VPN tunnel termination on the VIP address (DNAT), limitations and alternatives

  • October 15, 2024
  • 0 replies
  • 1751 views
Description The article describes the limitations of terminating the IPsec VPN on the VIP address (when DNAT is used), why it cannot be done, and what alternatives exist.
Scope FortiGate.
Solution

The following scenario is described:

 

IPSEC_VIP.png

 

Two FortiGates from the diagram are establishing an IPsec VPN S2S tunnel. FortiGate2 is configured in a way that the IPsec tunnel terminates on the VIP address (DNAT).

 

In such a scenario, an IPsec tunnel is never established.

FortiGate2 drops the VPN traffic with the following IPsec debug command: 'invalid SPI XXXXX, IPsec SA just negotiated'.

 

The scenario described above is not supported due to the architecture of the FortiGate and how the packets are processed.

 

Explanation:

The pre-route hook runs the inbound IPsec SA match before DNAT. Since the destination IP address has not been translated, the ESP packet  IP doesn't match the IP associated with the SA, and the packet is dropped. The SA match failed. The same thing also applies to the Dialup IPsec VPN connection initiated from the FortiClient.

 

Possible alternatives if DNAT is required:

  1. Secondary IP address configuration on the underlay interface for the IPsec
  2. Separate a NAT router in front of the FortiGate.
  3. Two different VDOMs: one to perform NAT, and one to terminate the IPsec tunnel.