| Description | This article describes that while using Azure load balancer between two FortiGate-VM on Azure Cloud, the tunnels come up, but the traffic does not go through. |
| Scope | FortiGate-VM, Azure. |
| Solution |
- As per the description of Azure Load Balancer, the traffic allowed is only limited to the TCP or UDP protocols, and it doesn’t support any other protocol to go through it e.g.: ESP, ICMP. - Since Azure Load Balancer does not allow other protocols to go through it, we need to convert it into either TCP or UDP. - The basic tunnel exchange uses UDP as seen in the below capture,.
- After the tunnel is established, the traffic exchange uses ESP protocol as below capture:
- To get the traffic through, we need to convert the ESP traffic to either TCP or UDP. - It is possible to use NAT- Traversal (NAT-T) option on IPSec to encapsulate ESP traffic under UDP header and the traffic will pass through the Azure Load Balancer.
Related article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPSec-VPN-nattraversal/ta-p/197873 |
