port-forwarding-through-an-ipsec-tunnel-to-a-remote-serverpc-with-fortinet doesnt work

Forum|Forum|7 years ago
November 6, 2018
3 replies
6051 views

Hi all

I have two site

SiteA Fortinet A

--- WAN1: 55.55.55.20

----WAN2: 172.18.254.1

--- Int1: 10.20.1.1 --- Port 3394 should be forwarded from WAN1 to 10.10.1.17 in Site B SiteB Fortinet B

--- WAN1: 66.66.66.60

----WAN2:172.18.254.2

---- Int1: 10.10.1.1

--- Server on 10.10.1.17 port 3389 open and ready

I create vpn using siteA WAN2 and siteB WAN2. Its work

Now need when users connect to siteA WAN1 port 3389 there was redirect through ipsec vpn to siteB to server 10.10.10.17

I create Ip virtual and ip policy. But it doesnt work.

Can anyone help me?

Best answer by Toshi_Esumi

I think the users are coming from outside hitting SiteA wan1 and vipped to SiteB via wan2. Then two potential problems: a) phase2 selector doesn't include the source IP, which could be avoided by using the default (0/0<->0/0) for the selector, and b) routing back from B->A for the source, which is not too easy to solve unless the default route at SiteB is pointing into the tunnel to go out via SiteA. Needs SNAT on the sources.

But I would set a VIP at SiteB and let users to use SiteB's WAN1 for RDP for simplicity.

emnoc

New Member

With out seeing the cfg it;s hard to say. Are you needing a VIP { DNAT } at siteB? If the address are rfc1918 why do you think you need a VIP?

Toshi_EsumiAnswer

SuperUser

I think the users are coming from outside hitting SiteA wan1 and vipped to SiteB via wan2. Then two potential problems: a) phase2 selector doesn't include the source IP, which could be avoided by using the default (0/0<->0/0) for the selector, and b) routing back from B->A for the source, which is not too easy to solve unless the default route at SiteB is pointing into the tunnel to go out via SiteA. Needs SNAT on the sources.

But I would set a VIP at SiteB and let users to use SiteB's WAN1 for RDP for simplicity.

flanker657614Author

New Member

Thank you. So in the end they did.

Sign up

Login with SSO

Login to the community

Login with SSO