IPSec-Site-To-Site (remote ip should be Public ip add or private ip add?)

Forum|Forum|5 years ago
February 18, 2021
3 replies
4627 views

Hi, I am working on setting up IP sec VPN site to site on each fortigate.

May question is, Do I need to use public ip address(i use ip chicken to see my public ip) as a remote IP?

Or it should be private IP address of fortigate that is connected to WAN1(192.168.254.70)?

Default Gateway of fortigate is: 192.168.254.254

sw2090

SuperUser

If you try to connect from the internet you canot se the internal address of WAN1 as it is not available to public and 192.168.0.0 will not be routed anyways.

So you have to use the public ip as remote gw.

Seeing your WAN1 IP I assuem there is some router behind WAN1 that does the internet and the FGT is not doing PPPOE itself there. In this case you also need to portforward on the router to make IPSec connections reach the FGT.

So you have to forward:

500/udp to 192.168.254.70 (IPSec)

4500/udp to 192.168.254.70 (NAT-T)

if the opposite site has similar constellation you have to do same way there.

the S2S itself doesn't need to have an IP. It is usually ust used as transport layer and the rest is done by routing and policies (or if needed vxlan).