ESP

[Anne]

Hi there, We are setting up a tunnel between a Source (behind a Fortigate 310B Firewall) and a device on the Internet. The inbound rule on the Fortigate Firewall is: Source: Public IP Destination: Private IP Service: udp 500/4500 and ESP We are doing NATTING of Private IP listed above with the External interface IP address which is a public address. I have created a Virtual IP mapping the external interface IP address with the private address (defined as destination above). Then I did port forwarding for udp 500 and 4500. My question is how can I do the mapping for ESP because when I select the port forwarding option it only gives me the option for TCP/UDP/SCTP and not ESP Thanks in advance Anne

[romanr]

Hi, you cannot do a portforward which is forwarding ESP. I would suggest you enable NAT-T (nat traversal) on your IPSec configuration and you will only need udp ports 500 and 4500! br, Roman

[investfalcon]

Spider Solitaire, Did you reboot after the change was made? If so, I would open a ticket at TAC whatever the version is. 

[seshuganesh]

Hi Team,

As far as i know, you do not need to do VIP for ESP traffic.

Make sure ESP protocol is accepted in firewall policy service. This should be fine.

Please test and give us update