Question
IPSEC VPN from fortigate to AWS
Hello,
I'm trying to set up a site-to-site VPN with an AWS VPC from a fortigate 60D running FortiOS 5.4.
I've downloaded the VPN CLI config from AWS and entered it into the fortigate to setup the IPSEC, static routes and firewall policies.
The tunnel shows as UP on the fortigate and in AWS but when I try to ping (or RDP) an instance in the remote (AWS) subnet it fails.
I've tried with and without NAT but the result stays the same.
Traceroute doesnt get beyond the Fortigate gateway IP so I would guess there's still something in the firewall that's blocking it.
I do see the traceroute and pings hit the VPN firewall policy.
The config is pretty straightforward:
config vpn ipsec phase1-interface
edit vpn-021ef34682e48cc4f-0
set interface "wan1"
set dpd enable
set local-gw 1.2.3.4
set dhgrp 2
set proposal aes128-sha1
set keylife 28800
set remote-gw 4.3.2.1
set psksecret sekret
set dpd-retryinterval 10
next
end
config vpn ipsec phase2-interface
edit "vpn-021ef34682e48cc4f-0"
set phase1name "vpn-021ef34682e48cc4f-0"
set proposal aes128-sha1
set dhgrp 2
set pfs enable
set keylifeseconds 3600
next
end
config global
config system interface
edit "vpn-021ef34682e48cc4f-0"
set vdom "root"
set ip 169.254.41.58 255.255.255.255
set allowaccess ping
set type tunnel
set tcp-mss 1379
set remote-ip 169.254.41.57
set interface "wan1"
next
end
config router static
edit 4
set device "vpn-021ef34682e48cc4f-0"
set dst 10.0.0.0 255.255.0.0
next
end
config firewall policy
edit 5
set srcintf "vpn-021ef34682e48cc4f-0"
set dstintf "internal"
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ALL
next
end
config firewall policy
edit 6
set srcintf internal
set dstintf "vpn-021ef34682e48cc4f-0"
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ALL
next
end
Anyone that could point me in the right direction?
Thank you in advance.
