Fortigate won' t communicate via VPN

Question

I have a FortWifi 30D connected via IPSEC VPN to a Fortigate 60C.  Behind the FWF30D is an IP-phone that one of our users has at their home office.  The phone  working normally and can connect to the HQ network via VPN.  I have a Fortianalyzer in the same IP range as some of my VOIP equipment that the phone communicates with.  I would like to get the FWF30D to send its logs to the Fortianalyzer.  I can ping from the FAZ to the FWF30D' s LAN address, and to the IP-phone beyond it.  I cannot trace or ping from the FWF30D (via CLI) to the FAZ.  It seems like the FWF30D will not send its traffic through its own IPSEC VPN.  Any ideas on how to resolve this?    Specs:  FWF30D  v5.0,build4459 (GA)    Fortigate 60C  v4.0,build0672,130904 (MR3 Patch 15) (yes I know its old)    FAZVM64  v5.0.7-build0321 140627 (GA)      Prior to the FWF30D we had a FWF50B doing the same thing.  The FWF50B died, and we replaced it with the FWF30D.

emnoc · Accepted Answer

I don' t think t he VPN policies are going to work here what you need to do to validate.    1: set the ping-option for the source address and then ping the  FAZ from cli     execute ping-options  source y.y.y.y  <---- your inside src interface     2: if not , do you have a policy?    3: have you ran  diag debug flow ?    Next, you know you can set the  FAZ source address and also encrypt the traffic via a tunnel from the  FGT to the FAZ.    e.g      config log fortianalyzer setting      unset override      set status enable   <-------enable it !st       set ips-archive enable      set address-mode static      set server 1.1.1.1  <------- here is your FAZ address       set encrypt enable     <------- enable this for encryption        set enc-algorithm high       set localid " FGTXXXXXXXXX"    <-----this needs to match what your FAZ has for the device name       set conn-timeout 30      set monitor-keepalive-period 15      set monitor-failure-retry-period 5      set source-ip y.y.y.y    <-------try your inside address   end        Give that a try and see where it leads you. In our FAZ we have them stuck behind a FGT cluster and just run encrypted tunnels off the FGTs to the  remote FAZ.    Running  the traffic thru a  ipsec-vpn-tunnel , is just adding more over head.    note: you need to run  diag debug flow 1st to see what your fortigate is doing or not doing with the flow.

ShrewLWD · Answer

Hi Jeff,    Let' s rule out a few basic things quick;  (You didn' t mention if your IPSEC tunnels are policy or interface)  If your tunnels are interface, are you sure you have a firewall policy for each direction, and that neither are NAT' d?  If your tunnels are policy based, are you sure that the IPsec firewall policy is set in a higher priority order within the polices, so that the traffic isn' t doesn' t instead go out the general outbound policy?

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded