Technical Tip: IPsec VPN tunnel termination on the VIP address (DNAT), limitations and alternatives
| Description | The article describes the limitations of terminating the IPsec VPN on the VIP address (when DNAT is used), why it cannot be done, and what alternatives exist. |
| Scope | FortiGate. |
| Solution | The following scenario is described:
Two FortiGates from the diagram are establishing an IPsec VPN S2S tunnel. FortiGate2 is configured in a way that the IPsec tunnel terminates on the VIP address (DNAT).
In such a scenario, an IPsec tunnel is never established. FortiGate2 drops the VPN traffic with the following IPsec debug command: 'invalid SPI XXXXX, IPsec SA just negotiated'.
The scenario described above is not supported due to the architecture of the FortiGate and how the packets are processed.
Explanation: The pre-route hook runs the inbound IPsec SA match before DNAT. Since the destination IP address has not been translated, the ESP packet IP doesn't match the IP associated with the SA, and the packet is dropped. The SA match failed. The same thing also applies to the Dialup IPsec VPN connection initiated from the FortiClient.
Possible alternatives if DNAT is required:
|
