IPSec VPN betweeen Cisco ASA and Fortigate

Fortigate Firmware version 4 MR2 with Cisco ASA Firmware 8.2.1 Thank

1st off your digram and cfgs where a big help. 2nd why do you have vpn define as both a phase1/2 and phase1/2-interface? 3rd, I think you problems resides around the set nat enabled on the firewall policys at the FGT side. You don' t need this enabled. I would do the following ; delete these edit 2 set srcintf " internal" set dstintf " wan1" set srcaddr " Local_LAN" set dstaddr " Remote_LAN" set action ipsec set status disable set schedule " always" set service " ANY" set logtraffic enable set inbound enable set outbound enable set vpntunnel " FGTtoASA" and then I would stay with interface and route-mode vpn, so delete this; config vpn ipsec phase1 edit " FGTtoASA" set interface " wan1" set keylife 86400 set proposal 3des-sha1 set dpd disable set remote-gw 192.168.0.6 set psksecret ENC oeX+CO11kI1yYtnP2dzvZwSGdNbXQvg1hxf1h0CqalxBn1U0mwBSrkLk1Ifc9pfCWb2o4eFcK6vEpa8vZu176oEXaBIEaFTmdK9T+0FAyh8ci+sf next end config vpn ipsec phase2 edit " FGTtoASA2" set dst-addr-type name set keepalive enable set phase1name " FGTtoASA" set proposal 3des-sha1 set replay disable set src-addr-type name set dst-name " Remote_LAN" set keylifeseconds 28800 set src-name " Local_LAN" next end next I would clean up the other firewall policies; edit 3 set srcintf " internal" set dstintf " FGTtoASA_IN" set srcaddr " Local_LAN" set dstaddr " Remote_LAN" set action accept set schedule " always" set service " ANY" set logtraffic enable unset nat enable next edit 4 set srcintf " FGTtoASA_IN" set dstintf " internal" set srcaddr " Remote_LAN" set dstaddr " Local_LAN" set action accept set schedule " always" set service " ANY" set logtraffic enable unset nat enable next That would clean up he FGT side of things. On the cisco side it looks okay but I don' t think Name and using 60.0.0.0 and 50.0.0.0 is going to work. You should use the proper group-object Something like this; object-group Local_LAN network-object 60.0.0.0 mask 255.255.255.0 object-group Remote_LAN network-object 50.0.0.0 mask 255.255.255.0 Outside of the above, that would clean up things.