Skip to main content
demetriusaustin
demetriusaustin
New Member
November 7, 2015
Solved

IPSEC VPN on private IP Fortigate WAN w/Fortiextender not coming online

  • November 7, 2015
  • 1 reply
  • 9142 views

Trying to get this configuration sorted out for to successfully establish an IPSEC VPN tunnel using the following hardware:

[ul]
  • AT&T hotspot w/public IP address
  • Fortiextender 100b into the WAN port with a private IP of 10.100.1.110
  • Fortiwifi 30d w/internal interface set to private IP of 10.1.13.211 & DHCP enabled w/10.1.13.110-200[/ul]

    Remote endpoint for the tunnel is a VMWare Edge server and the remote tunnel is already set up to allow traffic from the public IP address and private peer of 10.1.13.0/24.

     

    I have created the VPN local endpoint as well, bot Phase I and Phase II.

     

    Policies are in place for all interfaces including the FortiExtender, but the tunnel will not come online. I can imagine this is likely due to something missing in the configuration:

    [ul]
  • There is likely some NAT'ing that I am missing
  • Maybe a policy or two that I am missing[/ul]

    NOTE: All devices behind the firewall will be connected via the LAN interface on the 10.1.13.x subnet.

      • Best answer by ede_pfau

      I'd say yes, a dial-out IPsec VPN should be possible. If the remote FGT dials into the HQ FGT traffic would need a public source address for routing but the tunnel would not need to rely on it. Instead, you use Aggressive mode with peer IDs.

      This is well documented in the Cookbook, or, if you can, use the IPsec VPN wizard in FOS v5.2.

      1 reply

      ede_pfau
      SuperUser
      ede_pfau
      SuperUser
      November 7, 2015

      Well then, post the port configs (text only, please).

      The port the FEX is on needs to be "dedicated". As soon as the port detects a FEX this option is offered in "conf sys int".

      You then ignore the WAN  port in your policies; only the virtual port the FEX tunnel is symbolized by is used. IIRC the name of the port is predefined by FOS.

       

      Regarding NAT: the FEX would need to receive a public IP address and traffic destined to "WAN" (not the WAN port, but the FEX virtual port) would have "NAT" checked.

      demetriusaustin
      demetriusaustinAuthor
      New Member
      November 8, 2015

      @ede_pfau thanks for the response.

       

      Just so you are aware and sorry I didn't make it clear in the original post, the fext_wan1 interface is dedicated and I have a policy for it. You are correct in that the WAN port doesn't matter because the virtual port is dedicated to WAN traffic.

       

      Is there anyway to successfully configure the tunnel with only the hotspot/modem having a public IP address in this scenario? Inquiring because I have had a hell of a time with AT&T to even get the initial public IP address even after I mentioned to them to NOT assign it to the modem. I am more than 12hrs into phone conversations with incredibly "intelligent" people and I was hoping I could get the tunnel up without having to continue down the road of either getting the current IP address removed and/or a second IP address added.

      ede_pfau
      SuperUser
      ede_pfauAnswer
      SuperUser
      November 10, 2015

      I'd say yes, a dial-out IPsec VPN should be possible. If the remote FGT dials into the HQ FGT traffic would need a public source address for routing but the tunnel would not need to rely on it. Instead, you use Aggressive mode with peer IDs.

      This is well documented in the Cookbook, or, if you can, use the IPsec VPN wizard in FOS v5.2.

      Terms & ConditionsAccessibility statement