Skip to main content
Alxndr3
Alxndr3
New Member
September 26, 2018
Question

Impossibility to reach device through VPN

  • September 26, 2018
  • 1 reply
  • 6842 views

Hello.

Please,

I've set up a vpn between a Fortigate 90D v5.4.8,build1183 (GA) LAN 192.168.130.1 and a Fortigate 100D v5.6.4 build1575 (GA) 10.241.10.1, I can ping lans in both sides, but pinging on the device itself, for example from 90D to 100D it does not work, it works if I set it to ping from source 192.168.130.1, because of that I can't configure Fortianalizer.

I have other Fortigates configured the same way and that doesn't occurres.

Thank you.

    1 reply

    tanr
    tanr
    New Member
    September 26, 2018

    So your (IPsec?) VPN is working between the lans, but logging from the remote FortiGate to a FortiAnalyzer across the VPN isn't working?

     

    The FortiAnalyzer should be expecting the FortiGates internal IP (not the public IP used for the VPN). This is assuming you're connecting to the lan IP of the FAZ through the VPN.

      config log fortianalyzer setting     set source-ip <FortiGate Internal IP>   You'll need to have your routes and security policies defined to allow this.  The security policies, since they are going lan to lan through the VPN, should not use NAT.

    emnoc
    emnoc
    New Member
    September 26, 2018

    You could maybe set  a ip address in the vpn tunnel and  src-ip from that interface.

     

    Ken Felix

    Alxndr3
    Alxndr3Author
    New Member
    September 27, 2018

    Thank's for the response.

    Yes, logging from the remote FortiGate to FortiAnalyzer across the VPN isn't working.

     

    From FortiAnalyzer I reach the local FortiGate's local interface.

    FortiAnalyzer-400C # execute ping 192.168.130.1 PING 192.168.130.1 (192.168.130.1): 56 data bytes 64 bytes from 192.168.130.1: seq=0 ttl=254 time=28.338 ms 64 bytes from 192.168.130.1: seq=1 ttl=254 time=97.904 ms 64 bytes from 192.168.130.1: seq=2 ttl=254 time=105.249 ms 64 bytes from 192.168.130.1: seq=3 ttl=254 time=28.374 ms

    --- 192.168.130.1 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 28.338/64.966/105.249 ms

    FortiAnalyzer-400C #

     

    Now, from FortiGate (192.168.130.1) I can't reach FortiAnalyzer (10.241.10.3)

    FGT-DP4RS # execute ping 10.241.10.3

    PING 10.241.10.3 (10.241.10.3): 56 data bytes

    --- 10.241.10.3 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss

     

    Unless

    FGT-DP4RS # execute ping-options source 192.168.130.1

    FGT-DP4RS # execute ping 10.241.10.3 PING 10.241.10.3 (10.241.10.3): 56 data bytes 64 bytes from 10.241.10.3: icmp_seq=0 ttl=62 time=27.7 ms 64 bytes from 10.241.10.3: icmp_seq=1 ttl=62 time=30.0 ms 64 bytes from 10.241.10.3: icmp_seq=2 ttl=62 time=28.6 ms 64 bytes from 10.241.10.3: icmp_seq=3 ttl=62 time=28.0 ms 64 bytes from 10.241.10.3: icmp_seq=4 ttl=62 time=28.9 ms

    --- 10.241.10.3 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 27.7/28.6/30.0 ms

    Terms & ConditionsAccessibility statement