FEMTOCELL does not connect behind the FG

[Daqas]

Hello guys.

I have a 90D fortigate and in my network a FemtoCELL device used to increase smartphone coverage.

This device makes an IPsec VPN connection to the mobile operator's servers.

The problem is that it does not connect behind the Fortigate, but behind the ADSL modem it works perfectly.

Using the sniffer for on the source IP and for the IP destinations I a see the connections coming out of the FG but not coming in.

830.035152 LAN in 192.168.0.93.50124 -> 186.231.49.46.123: udp 48 830.035429 wan1 out 192.168.25.12.50124 -> 186.231.49.46.123: udp 48 830.035562 LAN in 192.168.0.93.50124 -> 186.231.49.42.123: udp 48 830.035761 wan1 out 192.168.25.12.50124 -> 186.231.49.42.123: udp 48

Only connection to NTP port exits and it should pass more UDP ports.

The firewall rule is very simple and without the use of packet filtering.

config firewall policy edit 2 set name "Allow_Femtocell" set uuid 09ae009a-6ddc-51e9-a649-cead6848e003 set srcintf "LAN" set dstintf "INTERNET" set srcaddr "IP_FEMTOCELL" set dstaddr "all" set action accept set schedule "always" set service "ALL" set logtraffic all set nat enable next end

I can not figure out where the problem is to cause the connection to hang.

Ports default the Femtocell: UDP 123 (NTP) UDP 500 (IKE) UDP 50 (re-mail-ck ) UDP 51 (la-maint) UDP 4500 (IPSEC) UDP 53 (DNS) UDP 67 (DHCP) Bootps UDP 68 (DHCP) Bootpc

[Toshi_Esumi]

Based on the sniffing result, 192.168.25.12 is the IP on wan1. Then must be another device NATing again to a public ip. Is that your intended design? Behind an ADSL modem/router would have a single NAT.

[Daqas]

Thank you for dedicating your time.

Yes, it's an ADSL modem behind. Unfortunately our main link with public ip is with probema.

This Femtocell has no management or access.

Do you believe the problem is going through NAT?

The Sniffer does not pass any IPsec port is what I find stranger.

[Leen]

Hi, you state the ADSL modem has NAT enabled, this means the internal LAN connection already has a private IP address. Therefore it is not needed for the Fortigate to have NAT enabled. Disabled this and you will see that your FEMTOCELL will work.

Most modems have Upnp enabled, I strongly encourage you to disable this on that modem.

Any forwarding should be done manually, you don't want to open your network for internal applications that use Upnp to create an inbound connection.