Skip to main content
A
Anonymous_User
Contributor
April 14, 2009
Question

Site to Site VPN from FortiGate to Checkpoint

  • April 14, 2009
  • 3 replies
  • 4846 views
Dear All, I am facing a problem on the above topice. Let me first explain you my setup. Site 1: Foritgate firewall firmware version 3.0 Site 2: Checkpoint firewall with version R65 installed on IPSO To configure the FortiGate firewall I have gone through the below Article Modified 11/30/2007 Keywords: checkpoint,vpn,configuration,ipsec,NGX,firewall Article ID: 2091 The same way I configured the Fortigate and as well as the checkpoint firewall. I am facing the following problem 1- The tunnel is not UP 2- There is no process after the Quick mode completion I request you all to go through the document, before answering my query. The reason is in the document three section I am confused 1- Configure a Firewall Virtual IP Pool 2- Configure a Firewall Virtual IP address 3- Configure Incoming Firewall Policy So pls any help me. This is so urgent for me. Thanks in advance. Regards, Basha

    3 replies

    doshbass
    doshbass
    New Member
    April 14, 2009
    Basha, Forgive me, but I really don' t want to go though teh document. In my experience with CP and Fortigate, you need to do some debugging to find outr where the problem is. You should be getting error logs eithr on the checkpoint or the Fortigate. If you are trying to bring up the tunnel from teh FG, then the error will appeer on the CP and vice versa. A firewall Virtual IP pool, is used to so that traffic leaving the fortigate seems to come from teh IP address configured in the pool. If your actual address range is what is configured in your phase 2 then you don' t need it. A firewall Virtual IP address is used to allow traffic coming back down teh tunnel to be directed to a single address, again if your networks do not overlap with each other and are correctly specified in the Phase 2 teh you don' t need this. Configure incoming firewall policy is required to let the tunnel come up. So allow teh traffic from teh remote site into the network you wish. ALso in my experience, the CP is normally unhappy because it is expecting to NAT on th einterface of the outside interface. Try to check your address translation rules on CP, ther should be an exempt set of subnets for VPNs
    red_adair
    red_adair
    New Member
    April 15, 2009
    #diag debug ena #diag debug app ike 3 This should give you some help to understand whats happening during Phase1/Phase2. Also note that CP sends Phase2-Quickmode Selectors according to their " remote Network" Settings. You have to specifiy the same (opposite direction of course) on the FGT side. If the QM Selectors does not match you' ll see an " INVALID_ID" error in the debug output. Forehand mentioned debug is pretty verbose - but with an understanding of IPSec it will reveal all the secrets that happens during P1/P2. -R.
    A
    Anonymous_UserAuthor
    Contributor
    April 17, 2009
    Dear All, I fixed the problem, I used the document FortiGate to CISCO PIX VPN document. I did the same configuration as it is in the doc. Then on CP I just followed the document VPN-1 VPN Interoperability. Now I can able to establish the VPN Thanks again for all you. Regards, Basha
    Terms & ConditionsAccessibility statement