FortiWiFi 60C - IPSEC VPN Phase1 is working Phase2 is not working

Question

Hi Guys

Can someone help me please. We have a working VPN A. We created new VPN B and its tunnel phase1 is up but nothing is passing on phase 2 , it will only past host to host in VPN B, in which the whole network block of those host is passing at VPNA only host to host will be done for VPNB. Our FortiWiFi60C is behind a dsl.

This FortiWifi60C is unable to assign VPN Interface on Policies etc... , it uses the Physical Interface

FORTINET

VPNA (WAN1) P1 - x.x.x.x ------------------------------------> working

P2 - 172.30.49.177/24 --------> working

VPNB (WAN2) P1 - y.y.y.y ----------------------------------> working

P2 - 172.30.49.183/32 -------> not working

REMOTE DEVICE

REMOTE LAN VPNA- 172.24.128.0/24

REMOTE LAN VPNB- 172.24.128.194/32

-------------------------------------------

Below are the settings

VPNB P2

phase1 - VPNB

encrypt - 3DES

authentication - SHA1

DH - 5

Source subnet - 172.30.49.183/32

Destinsation subnet - 172.24.128.194/32

ROUTE:

0.0.0.0/0.0.0.0 192.168.1.1 WAN1

0.0.0.0/0.0.0.0 192.168.1.1 WAN2

y.y.y.y 0.0.0.0 WAN2

172.24.128.194/32 0.0.0.0 0.0.0.0 WAN2

POLICY ROUTE

1 172.30.49.183/32 172.24.128.194/32 WAN2

2 172.30.49.177/24 0.0.0.0 0.0.0.0 WAN1

POLICY

--Inside to WAN1--

1 172.30.49.177/24 0.0.0.0 0.0.0.0 ALL ALL

2 172.30.49.177/24 172.24.128.0/24 ALL IPSEC

--Inside to WAN2--

3 172.30.49.177/24 0.0.0.0 0.0.0.0 ALL ALL

4 172.30.49.183/32 172.24.128.194/32 ALL IPSEC

-----------------------------------------------------------------------

Topology

HQ REMOTE SITE

FORTINET WAN1 (VPNA)---->DSL---> INTERNET --> REMOTE DEVICE

WAN2 (VPNB)-->DSL---> INTERNET --> REMOTE DEVICE

On the remote device i can see that packet is encrypt is incrementing but decrypt is 0

On the fortinet i can see on the diagose vpn tunnel list VPNB encrypt is 0 and decrypt is incrementing

Please assist me on this, I think there is only problem somewhere.

Thanks!!!

ede_pfau · Answer

hi,

the reason why you cannot use VPNB when specifying an interface (e.g. in a route) is that it is not created as an interface!

When creating the VPN you did not tick the "Interface mode" option. Unfortunately, you cannot change that after phase1 is created.

My recommendation:

- delete and recreate VPNB completely, in "Interface mode".

- create the routes as needed, you can now specify "phase1name" as the interface

- change the policy's action to "ACCEPT" instead of "IPSEC"

Then, as you have narrowed down the phase2 selector and the policy addresses to a "/32" it's perfectly alright if the VPN only passes traffic from one single host to another (= /32). If you need to connet to several hosts, specify a smaller netmask.

Sign up

Login with SSO

Login to the community

Login with SSO