Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
siayred
New Contributor

Access to VLANs via IPSEC VPN

Hi there,

 

I've been stuck on this for some weeks now, so hoping someone can help!

 

We have a third party vendor that needs access to our network and VLANs. The setup (which we inherited recently) has a Fortigate 80F in front of Alcatel switches. I have set up an IPSEC VPN on the Fortigate to the remote side, and this is up and passing traffic. The remote side is attempting to ping the gateway address of one of the VLANs and not getting a response (I've verified this with packet capture on the firewall).

 

I have tried adding the VLAN network into Phase 2 on the VPN on our side, and verified that this has also been done on the remote side, but the pings are still failing. One thing I think may be causing it is that none of the VLANs currently have an interface on the firewall; all the VLAN config is on the core switch and there are static routes for each VLAN on the firewall with the core switch as the gateway IP. Is there anything else I can try short of changing the setup to administer the VLANs from the Fortigate?

12 REPLIES 12
siayred

Hi there,

 

Part of the difficulty with this is that we can't contact the admins on the remote side directly, we need to go through another company (long story), I've asked for more info but am not holding my breath!

The command provided does show the traffic arriving on the Fortigate

vbandha
Staff
Staff

Hi @siayred 

Can you run this command to confirm if packet seen on fortigate is coming from same subnet :

diag sniffer packet any "host <src IP> and host <dest IP>" 4 0 l

 

The other side may be SNAT the traffic 

 

sahmed_FTNT
Staff
Staff

Things to check:
- IPSEC phase 2 has 0.0.0.0 or all the vlans added which required to communicate over the tunnel
- Static routes are configured on both sides
- polices are configured with correct vlan interface to pass traffic over the tunnel

Security all we want
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors