| Description |
This article describes how to set up an IPSEC VPN between FortiGate and Sophos when FortiGate is behind NAT. |
| Scope | FortiGate. |
| Solution |
Example of topology: FortiGate(WAN1) 1.1.1.1<--> SNAT x.x.x.x <-> Internet <-> y.y.y.y Sophos
FortiGate uses 1.1.1.1 as a private IP address and SNAT to x.x.x.x as a public IP. Sophos using y.y.y.y as a public IP.
Note. All the pre-shared key (PSK) and proposals are the same between FortiGate and Sophos.
FortiGate IPSEC settings Phase1.
set interface "wan1" set remote gateway y.y.y.y
Sophos IPSEC settings Phase1.
remote x.x.x.x
Troubleshooting on FortiGate.
Phase1 is up but the tunnel is not up and FortiGate IKE debug is shown with the keyword 'INVALID-ID-INFORMATION'.
Set up 1.1.1.1 in the VLAN ID (optional) on Sophos side to make IPsec tunnel up.
If phase-1 is not coming up and in the IKE debug 'received notify type AUTHENTICATION_FAILED' error is observed, define the remote-id on the Sophos as shown below.
|
