Skip to main content
Mudassir_Shah
Mudassir_Shah
New Member
April 13, 2019
Question

VPN Site to Site Connectivity Issue using Fortigate device as NAT IP

  • April 13, 2019
  • 1 reply
  • 2611 views

Respected 

 

I am facing issue we have two sites to create connectivity IP Sec Tunnel site to site please see below both sites config 

 

1. VPN site to site from Fortigate device to Fortigate device 

Connected successfully but both network cant ping each other

Settings

First end fortigate device getting NAT IP for internet usage on Wan port 1 from ISP modem no Public define on Fortinet device

Second end fortigate device having Public IP internet face on WAN port 1 

Why not network pinging ?

 

 

2. VPN site to site from Fortigate device to Dell Sonic wall device 

not connected unable to bring up having Phase 1 IP sec issue peer ID having invalid information 

Settings

First end fortigate device getting NAT IP for internet usage on Wan port 1 from ISP modem no Public define on Fortinet device

Second end Dell Sonic Wall  device having Public IP internet face on WAN port 1 

Why not connected ?

 

Settings are define as per below document but still not successful please can any one help me i know issue is source fortigate device NAT IP not Public IP on wan port 1 thats why facing trouble 

 

https://kb.fortinet.com/kb/viewContent.do?externalId=11657

https://www.sysprobs.com/guide-to-setup-vpn-between-sonicwall-and-fortigate-ipsec-site-to-site-vpn

 

Waiting for response 

 

Regards 

Mudassir Shah 

+923222237917

 

 

 

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    April 14, 2019

    In a site-to-site VPN with two static or public WAN addresses these addresses are part of the phase1 authentication. If one address is unknown or behind a NAT device, you cannot use a traditional site-to-site VPN.

     

    If your first FGT does not get a public IP address then you will have no choice other than configuring the other FGT for dial-in VPN.

    All following steps on the FGT which has a static public WAN address:

    create a new VPN, type "custom"

    choose "Remote Gateway: Dialup User"

    choose "NAT Traversal"

    do not use "Mode config" or "IKEv2" (in this example)

    choose PSK, and a PSK

    choose "Main mode"

    choose "peer ID: specific" and make up a specific peer ID (string, like the name of the remote location)

    choose a local peerID

    configure phase1 encryption and phase2 encryption and subnets

    for "remote subnet" choose "0.0.0.0/0" to allow multiple subnets

     

    On the FGT with private WAN IP address:

    this setup doesn't change from what you have now, except for choosing the correct "localID" e.g. the location's name.

    Make sure that "Auto negotiate" (and "Autokey keep alive") is/are enabled.

     

    The remote FGT will now open a tunnel to the central (public WAN) FGT.

    You will have to look into routing after the tunnel is UP. You cannot set a static route onto a dynamic interface, like a dial-in VPN. IMHO the FGT will create a route on the fly if the tunnel is connected. You might have to experiment with the phase2 subnets on the FGT with private WAN address.

     

    Terms & ConditionsAccessibility statement