IPSec tunnel options - help!

Hi @mlfrohlich ,

I guess that you can get DHCP IPs(192.168.1.0/24 network) from the router, correct?  

If so:

1) Put the FGT behind the router so WAN interface on FGT can receive DHCP IP or you assign one 192.168.1.x/24 IP if you know what router's internal IP (it must be 192.168.1.y/24 as well) is.

2) On FGT, create a default static route via WAN interface, Gateway is 192.168.1.y

3) On FGT internal interface, create a DHCP server, configure a different subnet than 192.168.1.0/24 so you can dispatch DHCP IPs to the internal network;

4) Create an IPSec VPN, and enable "Nat Traversal" in phase1 settings.  FGT has to initial to bring up the IPSec VPN since you do not have access to the router to configure port forwarding.  Otherwise, the remote peer can bring up the tunnel by accessing the router's external IP and the router can port forwarding to the FGT WAN interface for IPSec IKE traffic.

the problem is imho that the fortigate tries to establish the ipsec but it cannot get any response from the peer because of the router. It would work if the FGT hat an interface connected to th same subnet the peer is in. But I guess that is an ipsec over the internet is it?

The problem is that PSec traffic uses Port 500/udp (and switches to 4500/udp if NAT-T is enabled) and this hits the router because if over internet the peer can only have the router wan ip as remote gw. If then there is no portforwarding on the router you won't get no ipsec communication.