Skip to main content
Anne
New Member
May 7, 2013
Question

ESP

  • May 7, 2013
  • 3 replies
  • 4306 views
Hi there, We are setting up a tunnel between a Source (behind a Fortigate 310B Firewall) and a device on the Internet. The inbound rule on the Fortigate Firewall is: Source: Public IP Destination: Private IP Service: udp 500/4500 and ESP We are doing NATTING of Private IP listed above with the External interface IP address which is a public address. I have created a Virtual IP mapping the external interface IP address with the private address (defined as destination above). Then I did port forwarding for udp 500 and 4500. My question is how can I do the mapping for ESP because when I select the port forwarding option it only gives me the option for TCP/UDP/SCTP and not ESP Thanks in advance Anne

    3 replies

    romanr
    New Member
    May 7, 2013
    Hi, you cannot do a portforward which is forwarding ESP. I would suggest you enable NAT-T (nat traversal) on your IPSec configuration and you will only need udp ports 500 and 4500! br, Roman
    investfalcon
    New Member
    April 25, 2022

    Spider Solitaire, Did you reboot after the change was made? If so, I would open a ticket at TAC whatever the version is. 

    seshuganesh
    Staff
    Staff
    April 25, 2022

    Hi Team,

     

    As far as i know, you do not need to do VIP for ESP traffic.

    Make sure ESP protocol is accepted in firewall policy service. This should be fine.

    Please test and give us update

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!