L2TP Passthrough (RESOLVED)

Forum|Forum|12 years ago
December 12, 2013
8 replies
24431 views

We are trying to enable L2TP passthrough to a Mac OS X Mavericks server. L2TP passthrough is fairly trivial on other routers, but our Fortigate 40C with FortiOS 5 is making it quite the challenge. I' ve setup port forwarding via Virtual IPs with the following: UDP 500 UDP 4500 UDP 1701 Then created a Policy entry as Incoming: wan1 Address: all Outgoing: internal Destination: the above VIPs Schedule: always Service: ESP, IKE, L2TP I' ve tried turning off/on NAT in that Policy, setting AutoIPSec to ' on' on the wan1 interface, having the router' s VPN on and off, adding other Ports (TCP 500, 4500, 1701, and 1293 both TCP and UDP). Still no luck. I' ve confirmed the VPN service is functioning properly on the OS X Server by connecting from an internal client just fine. I enabled logging on the Policy, and if VPN on the router is turned on I see the connections come from the external device on ports 500 and 4500 only. If VPN on the router is off, I get 0 packets on that Policy. Any help would be most appreciated! I' m familiar with routers, command line tools, etc., but not an expert on Fortigate.

emnoc

New Member

What if you remove port forwarding for a temporary test , make it a 1-2-1 VUIP, with services ALL and see if it works? if it works than you an conduct further test and diagnostics within your port-forward configurations. Back to your policy, you also must realize that the ESP traffic is not a port, so maybe port-forwarding is not going to help in that area. Did you run any diag debug flow on traffic for that policy ? Diag debug flow is your friend.

nabeardsAuthor

New Member

Thanks Emnoc. For the first test, are you saying to make a Virtual IP with just the server address, then setup a Policy that all Services go to it? (I' m not familiar with 1-2-1 VUIP, sorry!) Understood on ESP port forwarding; I had added it as a service to forward within the Policy. I have not tried diag debug flow yet. I' d love to get it actually working using your step 1 first, then try restricting and run this to see what' s going wrong. Neil

emnoc

New Member

Yes and that was suppose to be a VIP. Map a 1-2-1 VIP between public and inside and allow all. If that works, than troubleshoot the port forwarding and your fwpolicies. ( basically a VIP with no port forwarding ) Also diag debug flow will shed some light as to what might be the issue(s).

nabeardsAuthor

New Member

emnoc, I was able to get to the point where my internal Mac OS X VPN server is getting the IKE requests properly forwarded through the Fortigate. However, the VPN server cannot reply to the connecting VPN client (it constantly logs Phase 1 Retransmit messages until it times out). Using ' diag debug flow' , I was able to see that the IKE response is attempting to be sent to the wan1 IP address instead of the IP address of the actual client. So vpnServer:500->wanIPaddress:500 was in the debug console and I would expect vpnServer:500->vpnClient:500. I have disabled everything on the Firewall at this point, except for the two following rules: 1 internal wan1 all all always ALL Accept 2 wan1 internal all MMSall always ALL Accept and MMSall is a Virtual IP setup as: External Interface wan1 Type Static NAT <unchecked> Source Address Filter External IP Address/Range 0.0.0.0 - 0.0.0.0 Mapped IP Address/Range ipOfVPNServer - ipOfVPNServer <unchecked> Port Forwarding The only other settings I' ve played with are making the policy rule 2 act as a NAT, as a NAT with static port, and as a NAT with an IP pool equal to my VPN server IP pool (no difference between these); and enabling/disabling the ' Auto-IPSec' on both the wan and internal Interfaces. Any other suggestions to get to a solution? Neil

nabeardsAuthor

New Member

One more bit of info: LAN IPs: 192.168.1.100 - 192.168.1.230 VPN IPs: 192.168.1.90 - 192.168.1.94 External LAN IPs: 10.0.1.100 - 10.0.1.200 as well as some others (not overlapping anything 192.168.*.*)

Sign up

Login with SSO

Login to the community

Login with SSO