Skip to main content
Treuz
Treuz
New Member
June 6, 2018
Question

IPsec VPN help

  • June 6, 2018
  • 1 reply
  • 3604 views

Hello all, i need to create an IPsec VPN with a Public Authority that needs to reach an FTP server in my local network (192.168.0.0/24). They are expecting to reach my machine through a subnet defined by them that is 10.50.41.208/30, my ftp server is supposed to answer at address .209. My local subnet is 192.168.0.0/24 while the FTP machine is .20. What's the way to properly setup IPsec VPN and NAT/Routing to let my FTP server in local subnet be reachable through the addresses imposed by the client? I have a Fortigate 90D with firmware v5.6.3 build1547 (GA).

Thanks in advance.

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    June 6, 2018

    I think they would route the /30 into the tunnel on their end. You must have gotten another subnet on their end for you to route into the tunnel from your end. Then you can use VIP with .209 address for FTP protocols to map to your FTP server's local IP 192.168-something, and use it with the inbound policy for the VPN.

    emnoc
    emnoc
    New Member
    June 6, 2018

    Also phase2 stc-subnets must be the  VIP  address and not the server.

     

     

    e.g

     

     

    config vpn ipsec phase2-interface

        edit MYVENDOR

               set src-subnet 10.50.41.209/32

       end

     

    Treuz
    TreuzAuthor
    New Member
    June 6, 2018

    toshiesumi wrote:

    I think they would route the /30 into the tunnel on their end. You must have gotten another subnet on their end for you to route into the tunnel from your end. Then you can use VIP with .209 address for FTP protocols to map to your FTP server's local IP 192.168-something, and use it with the inbound policy for the VPN.

    Correct: they have provided another /29 subnet for me to route into the tunnel.

     

    emnoc wrote:

    Also phase2 stc-subnets must be the  VIP  address and not the server.

    e.g

    config vpn ipsec phase2-interface

        edit MYVENDOR

               set src-subnet 10.50.41.209/32

       end

     

    I'm not very familiar with console so i'm using the web interface.

     

    So if my understanding is correct i need to setup the VPN tunnel between the two subnet with the /30 (or the single /32 address?) as source and the other subnet as destination. Then i create a VIP entry from .209 to my FTP server on local 192.168.x.x and I add this entry into an allow policy in the tunnel interface.

    Terms & ConditionsAccessibility statement