New Member

Solved

Fortigate200D-Fortigate800C Site-to-site VPN Setup

8 replies
7264 views

Hello,

I have configured site to site vpn between Fortigate 200D-800C, and the tunnel is up, but there is no

traffic going out and coming in, after investigating by capturing the icmp traffic, I found that the source address traffic is coming from the Management Interface rather than the required LAN Port 1.

please help

Thanks

Ahmed

mg-fg.JPG

5.0

rwpattersonAnswer

New Member

Make sure the distance is less than that of your default gateway. 10 is the usual distance for the default which is the same as your tunnel traffic. Make the tunnel traffic anything lower. I use 5 myself.

gschmitt

New Member

Did you remember to create policies to allow incoming and outgoing traffic on both sides?

Do you have static routes pointing to the IPSec Tunnels?

hersiguureAuthor

New Member

Hi gschmitt,

I have created both incoming and outgoing policies for fortigate firewalls, also i have created a static route pointing to Phase 1 Interface,

THanks

emnoc

New Member

The diag debug flow is your best friend here. Apply a filter to match on your traffic and review the diagnostic output.

A few things to look for, bad fw-policies, bad ordering or sequence of fw-policies, phase#2 is not up, PBR over-ridding the static route(s),etc....

hersiguureAuthor

New Member

Emnoc,

I have ordered the fw-policies as follows

Incoming Policy

Phase 1 interface -- Remote-LAN --- Local Port --- Local LAN

Outgoing

Local Port --- Local LAN ---- Phase 1 Interface --- Remote LAN,

Also static route is as followss

Destination Network --- Device(Phase 1 Interface), Distance 10

and phase 2 up

rwpattersonAnswer

New Member

Make sure the distance is less than that of your default gateway. 10 is the usual distance for the default which is the same as your tunnel traffic. Make the tunnel traffic anything lower. I use 5 myself.

emnoc

New Member

diag debug flow

Sign up

Login with SSO

Login to the community

Login with SSO