Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
JJ1
New Contributor

DMVPN / NHRP on fortigates

Hi All,

I'm trying to setup a VPN between a fortigate and a VyOS device, the fgt has dynamic external IP assigned so I wanted to use DMVPN in order to allow a interface mode VPN to work here. I had the same config between the VyOS and a Cisco router which worked fine, but so far haven't been able to get this working on the fortigate.

 

It's quite possible fortiOS doesn't support NHRP since I cannot find any info on the documentation, but since NHRP is based on GRE over IPSEC and that is explained on the manual I though I would ask here before giving up.

 

Any information on the matter appreciated.

3 REPLIES 3
JJ1
New Contributor

Ok, so in the end I got this working by setting up a simple GRE over IPSEC.

Basically an IPSEC tunnel with a private IP configured at each and and then a GRE tunnel between those IPs, which gives me a tunel interface on the VyOS side where I can route my traffic to.

 

 

emnoc
Esteemed Contributor III

FWIW: That will create additional overheard ( 24bytes GRE ) and the ESP header. Is there any reason you need GRE?

 

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
JJ1
New Contributor

Not really, as I mentioned before all I want is an interface mode VPN.  Unfortunately, because the FGT has dynamic IP, the device in the other end (VyOS) doesn't let me create a VTI bound to an IPSEC which uses "named peer ID".

 

I've also opened a thread on the VyOS forum to see if there's a way around it on the other end.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors