Skip to main content
Tannv
New Member
January 26, 2018
Question

Site to site VPN

  • January 26, 2018
  • 3 replies
  • 4115 views

Hi,

 

I have configured vpn site to site between fortigate 60D(main office) and Cisco ASA 55xx(branch office), both sites can connect well.

I have tried to use Anyconnect to connect via Cisco ASA from home, After connected i can connect to all computer inside main office, but could not connect any computer at branch office.

I tried to ping from fortigate to Cisco ASA and vice versa but failed

 

Anyone can know the reason, how can i fix this?

 

Thanks a lot.

    3 replies

    emnoc
    New Member
    January 26, 2018

    The cli diag debug flow is your friend on a FGT. The  Packet-tracer on the cisco ASA is your friend. Run both of these and review the diagnostic output. You need route and fwpolicies and don't rule out any SNAT configurations.

     

    Both of these  tools is your 1st line tool for trouble-shooting

     

    Ken

    FortiKoala
    Staff
    Staff
    January 26, 2018

    Have a look at this cookbook http://cookbook.fortinet.com/ipsec-fortigate-cisco/ it describes the setups

     

    You might also want to troubleshoot the packet flow through the FortiGate http://kb.fortinet.com/kb/viewContent.do?externalId=FD31702

     

    Make sure your ip address is not being denied by the firewall policies

    Deepakkhw
    New Member
    January 30, 2018

    Please check below details,

    On Cisco ASA:

    1. Cisco anyconnect subnet must be in nonat acl.

    2. Anyconnect subnet must be on Crypto route map acl with destination subnet of your frotigate site. 

     

    On Fortigate:

    1. Anyconnect Subnet is allowed in Phase 2.

    2. The policy is configured on FortiGate to allow traffic.

    3. A route is configured for anyconnect subnet.

     

    Regards,

    Deepak Kumar

     

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!