Skip to main content
robink
robink
New Member
November 30, 2018
Question

Stand alone VPN device

  • November 30, 2018
  • 2 replies
  • 4687 views

I have a 30E and trying to setup a site to site VPN using the device as a stand alone VPN device behind a firewall. I have disabled the wan int and created a default route that points to actual site firewall. The Foritgate sees the internet, downloaded and installed an updated firmware. I connect communicate with the Fortigate through the firewall. With all that being said I cannot get the VPN to come online. The VPN is configured use the lan interface and in troubleshooting the issue I did some packet monitoring on the site firewall (firewall this device's traffic passes through) and I don't see any packets going to the IP address of the remote VPN gateway. I can see other traffic but not a single packet gets picked up for the remote VPN gateway. I use the "Bring UP" option on the VPN and still nothing. Really can't understand how this can be. I've done this exact same type of setup on a SonicWall a half dozen times without any issue. 

 

Only other thing I should note is that I did not register or activate any online features. Could that be preventing all VPN traffic?

 

 

 

 

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    November 30, 2018

    So you're trying the 30E "on a stick" topology, right? But VPN itself should come up via its internal interface then go over the GW FW if it's set up properly.

    If you don't see anything obviously wrong in the vpn config, you need to start debugging started with just pinging the peer GW IP to make sure it's reachable, then IKE debugging as described in below cookbook.

    https://cookbook.fortinet.com/ipsec-vpn-troubleshooting/

     

     

    robink
    robinkAuthor
    New Member
    November 30, 2018

    Thanks for the follow-up. I called support and the issue is resolved. It was my mistake in that I didn't setup the VPN routing or access rules yet as I got hung up on the fact that FortiGate would not even try to establish the tunnel (no packets passing through the perimeter firewall). On the SonicWall (which I used to) you don't need to worry about those things until you want to actually communicate "through" the VPN tunnel. Live and learn... :)

     

    lobstercreed
    lobstercreed
    New Member
    November 30, 2018

    robink wrote:

     

    Only other thing I should note is that I did not register or activate any online features. Could that be preventing all VPN traffic? 

    No, that would not have any effect.  I agree with Toshi...some methodical debugging is in order.  I've done a config almost identical to yours several years ago and encountered some routing challenges that packet capturing helped solve. 

    I think my issue at the time was that I put the FortiGate on the same subnet as the clients that were supposed to get out across the VPN.  Once I split the subnet so that the FG and its default gateway was different than the clients, things worked right.

    Terms & ConditionsAccessibility statement