Technical Tip: IPsec VPN tunnel termination on the VIP address (DNAT), limitations and alternatives

[jprokic]

Description	The article explains the limitations of terminating the IPsec VPN on the VIP address (when DNAT is used), why it cannot be done, and what alternatives exist.
Scope	FortiGate,
Solution	The following scenario is described: Two FortiGates from the diagram are establishing an IPsec VPN S2S tunnel. FortiGate2 is configured in a way that the IPsec tunnel terminates on the VIP address (DNAT). In such a scenario, an IPsec tunnel is never established. FortiGate2 drops the VPN traffic with the following IPsec debug command: 'invalid SPI XXXXX, IPsec SA just negotiated'. The scenario described above is not supported due to the architecture of the FortiGate and how the packets are processed. Explanation: The pre-route hook runs the inbound IPsec SA match before DNAT. Since the destination IP address has not been translated, the ESP packet  IP doesn't match the IP associated with the SA, and the packet is dropped. The SA match failed. Possible alternatives if DNAT is required: Secondary IP address configuration on the underlay interface for the IPsec Separate NAT router in front of the FortiGate. Two different VDOMs: one to perform NAT, and one to terminate the IPsec tunnel.