Skip to main content
mcdaniels
mcdaniels
New Member
October 1, 2017
Question

IPSEC Dial UP VPN behind a Router (Mikrotik)

  • October 1, 2017
  • 2 replies
  • 36392 views

Hi folks,

I have a little (big?) problem trying to configure a Mikrotikrouterboard to connect to a FGT100D.

 

The Mikrotik is sitting behind a router which points to the internet.The Router gives a LAN-address to the Mikrotik WAN-Port.

192.168.0.101/24.

 

The Mikrotik itself, gives connected Clients the IP-Range 192.168.88.0/24.

 

 

The official IP for connections to the internet is 77.110.xxx.yyy (static).

 

I am trying to connect to a LAN behind the Fortigate (10.0.0.0/24)

 

If I set up a IPSEC Dialup VPN the phase 1 is working properly, but I am struggeling with phase2 which never comes up.

 

My question is: As it is a dialup-connection initiated from the Mikrotik, which IP-Adresses do I have to use in the VPN Settings for local and remote Network?

 

What is the SA Src. Address / SA Dst. Address. In my opinion this should be the official IPs of both ends?

 

thx!

 

 

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 2, 2017

    This is a little old (5.0) and FG-to-FG, but the essential part should be the same especially on the server side. On the client side you need to translate the FG60D config to your device's config.

    https://video.fortinet.com/video/102/site-to-site-ipsec-vpn-behind-firewall-nat-device

     

    mcdaniels
    mcdanielsAuthor
    New Member
    October 3, 2017

    Hi thanks!

    Just tried it that way but Phase2 is not coming up. Settings  @Fortigate are ok. P1 is initiated in aggressive Mode and User ID. But as said Phase2 is not initiated. I do not see any attempts for the P2 in the VPN-Debug-Logs of the Fortigate.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 3, 2017

    Are you actually sending packets from the source subnet to the destination you configured in the phase2 on the remote router? Phase2 attempt in dial-up situation is completely up to the remote end. If you don't see any attempts on the FG side, the remote route is not attempting.

    mcdaniels
    mcdanielsAuthor
    New Member
    October 3, 2017

    Hi,

    If I ping an IP from the dial-up site to the remote side, I can see that the mikrotik is setting up a SA, which says src address (my official ip at dial-up site) and the dst address of the remote site (Fortigate official IP.)

     

    But no Phase2.

     

    Networkscheme of configuration is attached. Is this supposed to work?

     

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 3, 2017

    Looks like a typical NAT traversal situation. No reason not to work to me.

    There seems to be be a Mikrotik forum. I would try asking there.

    Terms & ConditionsAccessibility statement