IPSec Tunnel with NAT - packets not received
Hi,
I've to configure an IPSec tunnel between a fortigate VM (local) and a FortiWiFi 40F (remote).
Remote site have a network configuration alreday used by another IPSec tunnel so i've to add NAT on this tunnel.
Tunnel is UP and configurations seems to be OK, but no packet are received on remote site.
Some informations :
<Local Networks> : 10.9.0.0/16 ; 10.20.0.0/16
<Remote Network> : 192.168.1.0/24
<Remote Network with NAT> : 192.168.10.0/24
My configuration :
- on VM :
- IPSEC Tunnel :
local address : <Local Networks>
Remote Address : <Remote Network with NAT>
- Static route :
set dst 192.168.10.0 255.255.255.0
set device "vpn"
- Firewall policy :
Accept ALL from <Local Networks> to <Remote Network with NAT>
- on FortiWiFi
- IPSEC Tunnel :
local address : <Remote Network with NAT>
Remote Address : <Local Networks>
- Static route :
set dst 10.0.0.0 255.0.0.0
set device "vpn"
- Firewall policy :
config firewall policy
edit 1
set srcintf "internal"
set dstintf "vpn"
set srcaddr "<Remote Network>"
set dstaddr "<Local Networks>"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all
set ippool enable
set poolname "ip-pool"
set nat enable
config firewall ippool
edit "ip-pool"
set startip 192.168.10.1
set endip 192.168.10.254
set source-startip 192.168.1.1
set source-endip 192.168.1.254
config firewall policy
edit 2
set srcintf "vpn"
set dstintf "internal"
set srcaddr "<Local Networks>"
set dstaddr "vip"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all
config firewall vip
edit "vip"
set extip 192.168.10.1-192.168.10.254
set mappedip "192.168.1.1-192.168.1.254"
Problem :
On local :
diagnose sniffer packet vpn
4.101766 10.20.x.x -> 192.168.10.x: icmp: echo request
8.716446 10.20.x.x -> 192.168.10.x: icmp: echo request
13.714733 10.20.x.x -> 192.168.10.x: icmp: echo request
18.715851 10.20.x.x -> 192.168.10.x: icmp: echo request
On remote :
diagnose sniffer packet vpn
<<nothing>>
Packets are sent from local but not received by remote.
Have you some ideas ?
