Access to VLANs via IPSEC VPN

[siayred]

Hi there,

I've been stuck on this for some weeks now, so hoping someone can help!

We have a third party vendor that needs access to our network and VLANs. The setup (which we inherited recently) has a Fortigate 80F in front of Alcatel switches. I have set up an IPSEC VPN on the Fortigate to the remote side, and this is up and passing traffic. The remote side is attempting to ping the gateway address of one of the VLANs and not getting a response (I've verified this with packet capture on the firewall).

I have tried adding the VLAN network into Phase 2 on the VPN on our side, and verified that this has also been done on the remote side, but the pings are still failing. One thing I think may be causing it is that none of the VLANs currently have an interface on the firewall; all the VLAN config is on the core switch and there are static routes for each VLAN on the firewall with the core switch as the gateway IP. Is there anything else I can try short of changing the setup to administer the VLANs from the Fortigate?

[siayred]

Hi there,

Part of the difficulty with this is that we can't contact the admins on the remote side directly, we need to go through another company (long story), I've asked for more info but am not holding my breath!

The command provided does show the traffic arriving on the Fortigate

[vbandha]

Hi @siayred 

Can you run this command to confirm if packet seen on fortigate is coming from same subnet :

diag sniffer packet any "host <src IP> and host <dest IP>" 4 0 l

The other side may be SNAT the traffic 

[sahmed_FTNT]

Things to check:
- IPSEC phase 2 has 0.0.0.0 or all the vlans added which required to communicate over the tunnel
- Static routes are configured on both sides
- polices are configured with correct vlan interface to pass traffic over the tunnel