Skip to main content
emhe13
emhe13
New Member
April 13, 2022
Question

IPse VPN site to site issue

  • April 13, 2022
  • 2 replies
  • 1721 views

Configure an IPSEC VPN site to site between two Fortigates, in one of the points there is a public IP but in the other site there is an adsl link I cannot put the modem in bridge mode but in DMZ, I have not been able to get these These are the screens I get when running the diagnose vpn ike log-filter dst-addr4 command

I don't know what setting I'm missing

 

FortiGate with DDNS modem in DMZ:

emhe13_0-1649893051819.png

FortiGate with IP public:

emhe13_1-1649893072941.png

 

2 replies

akristof
Staff
akristof
Staff
April 14, 2022

Hi,

Thank you for your question. What I would suggest, use dynamic tunnel on FortiGate with public IP address (so it will only listen for connection) and use static VPN on FortIGate with private IP address. Example:

https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/523447/configure-dial-up-dynamic-vpn

Then you don't need ddns and only IP address that is required is the public IP that the remote FortiGate (with privateIP) will be connecting to.

sw2090
SuperUser
sw2090
SuperUser
April 14, 2022

if your modem ain't in bridge mode you might have to set up portforwarding so that it forwards vpn traffic to your Fortigate.

You will need to forward 500/udp for IPSec and (If enabled) 4500/udp for NAT Traversal.

without that responses from one side cannot reach the other.

Result would be what you get: several tries to resend in p1 followed by a negotiation timeout...

Terms & ConditionsAccessibility statement