Skip to main content
achmad_nurfajri
achmad_nurfajri
New Member
April 6, 2017
Question

VPN IPSec Between Fortigate and Cyberoam

  • April 6, 2017
  • 2 replies
  • 11732 views

Hello Master. 

 

i have a fortigate  60D and a Cyberoam, and i had been configure VPN IPSec between it. 

the VPN is connected but i cant access the computer (RDP, PING, WEB, HTTPS) in the other side. 

i try to allow connection in filter rule in the both side, but i still cant access.

i try step by step in this link, and still cant access

[link]https://kb.cyberoam.com/default.asp?id=1945[/link]

 

any suggestion for my case? some tutorial link or something i must to do.  Thanks Very Much

    2 replies

    neonbit
    neonbit
    New Member
    April 6, 2017

    I'm assuming you're trying to connect from the FGT side to the RDP server on the Cyberoam side.

     

    First thing I would recommend is the diag debug flow command on the FGT side. This will determine if the FGT is sending the packets over the VPN, if it is then you'd have to look at troubleshooting on the Cyberoam.

     

    On the FGT run the following commands:

     

    diag debug flow filter daddr RDPserversIPaddress

    diag debug flow show console enable

    diag debug enable

    diag debug flow trace start 3

     

    After this try to RDP to the server and see what comes up. Confirm that the policyID matches the correct one and the route selected uses the IPSEC interface.

     

    FYI more details on the debug flow command can be found here: http://kb.fortinet.com/kb...teId=0%200%20103849130

    achmad_nurfajri
    achmad_nurfajriAuthor
    New Member
    April 7, 2017

    Dear Neobit, 

    i have been selected IPSec interface in route

    I try what you said.

    this is the result.

    My fortinet side is 20*.***.***.*** and cyberoam side is 2**.***.***.***

     

     

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 172.16.50.10:61998->172.16.2.51:3389) from internal. flag , seq 2459043432, ack 0, win 8192"

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=init_ip_session_common line=4569 msg="allocate a new session-00d6d0f9"

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=vf_ip4_route_input line=1586 msg="Match policy routing: to 172.16.2.51 via ifindex-69"

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-172.16.2.51 via VPN_GSS"

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=fw_forward_handler line=671 msg="Allowed by Policy-27:"

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-VPN_GSS"

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=ipsec_output_finish line=232 msg="send to 203.77.224.121 via intf-wan1"

     

    2017-04-07 10:13:11 id=20085 trace_id=213 func=esp_output4 line=897 msg="encrypting, and send to 20*.***.***.***with source 2**.***.***.***"

     

    2017-04-07 10:13:14 id=20085 trace_id=214 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 172.16.50.10:61998->172.16.2.51:3389) from internal. flag , seq 2459043432, ack 0, win 8192"

     

    2017-04-07 10:13:14 id=20085 trace_id=214 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-00d6d0f9, original direction"

     

    2017-04-07 10:13:14 id=20085 trace_id=214 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-VPN_GSS"

     

    2017-04-07 10:13:14 id=20085 trace_id=214 func=ipsec_output_finish line=232 msg="send to 203.77.224.121 via intf-wan1"

     

    2017-04-07 10:13:14 id=20085 trace_id=214 func=esp_output4 line=897 msg="encrypting, and send to 20*.***.***.***with source 2**.***.***.***"

     

    2017-04-07 10:13:20 id=20085 trace_id=215 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 172.16.50.10:61998->172.16.2.51:3389) from internal. flag , seq 2459043432, ack 0, win 8192"

     

    2017-04-07 10:13:20 id=20085 trace_id=215 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-00d6d0f9, original direction"

     

    2017-04-07 10:13:20 id=20085 trace_id=215 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-VPN_GSS"

     

    2017-04-07 10:13:20 id=20085 trace_id=215 func=ipsec_output_finish line=232 msg="send to 203.77.224.121 via intf-wan1"

     

    2017-04-07 10:13:20 id=20085 trace_id=215 func=esp_output4 line=897 msg="encrypting, and send to 20*.***.***.***with source 2**.***.***.***"

     

     

    and i still dont get it. 

    any something wrong?

     

    thanks before.

     

    harsh
    harsh
    New Member
    May 15, 2017

    Try these settings at cyberoam end to create new policy, AND USE THIS POLICY TO CREATE TUNNEL

     

    KEYING METHOD :- AUTOMATIC ALLOW RE-KEYING :- ENABLE KEY NEGOTIATION TRIES :- 5 AUTHENTICATION MODE :- MAIN MODE PASS DATA IN COMPRESS MODE :- DISABLE PERFECT FORWARD SECRECY PFS :- ENABLE PHASE 1 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM SHA1 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM MD5 DH GROUP :- 5 AND 14 KEY LIFE :-86400 REKEY MARGIN :- 120 RANDOMIZE RE-KEYING MARGIN BY :- 0 DEAD PEER DETECTION :- ENABLE CHECK PEER AFTER EVERY :- 30 SECOND WAIT FOR RESPONSE UPTO :- 120 SECONDS ACTION WHEN PEER UNREACHABLE :- RE-INITIATE PHASE 2 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM SHA1 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM MD5 PFS GROUP ( DH GROUP ) :- SAME AS PHASE-1 KEY LIFE :- 43200

     

    --------------------------------

    after creating tunnel add rule for lan to vpn and vpn to lan traffic in cyberoam firewall

    foritigate firewall os ver. 5.4 and cyberoam ver 10+

     

    harsh
    harsh
    New Member
    May 16, 2017

    1. Add vpn to lan rule in cyberoam

    2. Add lan to vpn rule in cyberoam

     

    Note :- allow all( user and ip's) and all services  in vpn rules

    Terms & ConditionsAccessibility statement