Connecting fortigate to Mikrotik 450G IPSEC

[Bono]

Has anyone managed to connect Fortigate to Mikrotik device or it has working config? I lost whole day debuging IPSEC errors and I still cannot connect to Mikrotik via tunnel. Encryption is not important I just need working tunnel, so please share your knowledge if you managed to connect. All info on Internet is not very useful. Thanks

[genar]

Hi,

i try to follow the instruction on that link, my tunnel is up but still can not ping from lan fortigate and lan mikrotik

any suggest?

i see on that link mikrotik can ping lan fortigate.

thank you

regards

[kinmun]

regarding the steps on the blog for the fortigate to mikrotik vpn setup. 

what is int-vlan10 and in-vlan20 and Miktotik02 on the fortigate configurations ?

do i have to create these interface on the fortigate network interface ?

i only have LAN,WAN, DMZ and mgmt interface on my FG now. 

[MariusM]

Hi kinmun,

Consider "int-vlan10" and "int-vlan20" as internal LAN. Those are two network segments in internal network. In your setup this will be the "LAN"

The "Mikrotik02" is the remote subnet, representing the IP subnet of the remote location that will be connected through VPN with the Fortigate. If you don't have this created, than you will need to create this in the Firewall section, as an object.

kinmun wrote:

regarding the steps on the blog for the fortigate to mikrotik vpn setup. 

what is int-vlan10 and in-vlan20 and Miktotik02 on the fortigate configurations ?

do i have to create these interface on the fortigate network interface ?

i only have LAN,WAN, DMZ and mgmt interface on my FG now. 

[Philippe_ASTIER]

OK, I may be stupid...

Mikrotik RB2011 (brilliant router by the way) to FGT60C (soon to be replaced).

I followed your (MariusM) setup. 

The tunnel is established, phase2 is there.

I can't get any traffic through. I can see packets increasing on the FGT side, but ping fails, as any other kind of traffic.

Yes, I do have IPv4 Policy on FGT side, this is where I see counters increasing.

I have setup an L2TP server on the RB2011 as well, and this one works fine.

Which step could I be forgetting ?

(as usual... I'm sure it must be very very stupid)

[Philippe_ASTIER]

OK... now I don't get it.

I used Mikrotik reference for IPSec tunnels, and added forward filter rules.

Traffic now goes from Mikrotik side subnet to the FGT side subnet. But not the other way round !

Getting mad...

(I love routing !!)

[ede_pfau]

The next step would be to follow a packet from the FGT LAN into the tunnel, using 'diag debug flow'. You can find zillions of posts here showing how to use it if you're not already familiar with it. This would show you whether or not the traffic reaches the tunnel - if it does, start debugging on the other side.

You can complement this approach with 'diag debug sniffer packet' on the LAN and the tunnel interfaces, resp. This will give you an immediate answer if traffic is present at the right places but won't give you any explanations for failures.