FortiWiFi 60C - IPSEC VPN Phase1 is working Phase2 is not working

[flodnar31]

Hi Guys

Can someone help me please. We have a working VPN A. We created new VPN B and its tunnel phase1 is up but nothing is passing on phase 2 , it will only past host to host in VPN B, in which the whole network block of those host is passing at VPNA only host to host will be done for VPNB. Our FortiWiFi60C is behind a dsl.

This FortiWifi60C is unable to assign VPN Interface on Policies etc... , it uses the Physical Interface

FORTINET

VPNA (WAN1) P1 - x.x.x.x ------------------------------------> working

                    P2 - 172.30.49.177/24 --------> working

VPNB (WAN2) P1 - y.y.y.y ----------------------------------> working

                       P2 - 172.30.49.183/32 -------> not working

REMOTE DEVICE

REMOTE LAN VPNA- 172.24.128.0/24

REMOTE LAN VPNB- 172.24.128.194/32

-------------------------------------------

Below are the settings

VPNB P2 

phase1 - VPNB

encrypt - 3DES

authentication - SHA1

DH - 5

Source subnet - 172.30.49.183/32

Destinsation subnet - 172.24.128.194/32

ROUTE:

0.0.0.0/0.0.0.0 192.168.1.1 WAN1

0.0.0.0/0.0.0.0 192.168.1.1 WAN2

y.y.y.y 0.0.0.0 WAN2

172.24.128.194/32 0.0.0.0 0.0.0.0 WAN2

POLICY ROUTE

1 172.30.49.183/32 172.24.128.194/32 WAN2

2 172.30.49.177/24 0.0.0.0 0.0.0.0 WAN1

POLICY

--Inside to WAN1--

1 172.30.49.177/24 0.0.0.0 0.0.0.0 ALL ALL

2 172.30.49.177/24 172.24.128.0/24 ALL IPSEC

--Inside to WAN2--

3 172.30.49.177/24 0.0.0.0 0.0.0.0 ALL ALL

4 172.30.49.183/32 172.24.128.194/32 ALL IPSEC

-----------------------------------------------------------------------

Topology

HQ                                                                       REMOTE SITE

FORTINET WAN1 (VPNA)---->DSL---> INTERNET --> REMOTE DEVICE

              WAN2 (VPNB)-->DSL---> INTERNET --> REMOTE DEVICE

On the remote device i can see that packet is encrypt is incrementing but decrypt is 0

On the fortinet i can see on the diagose vpn tunnel list VPNB encrypt is 0 and decrypt is incrementing

Please assist me on this, I think there is only problem somewhere.

Thanks!!!

[ede_pfau]

hi,

the reason why you cannot use VPNB when specifying an interface (e.g. in a route) is that it is not created as an interface!

When creating the VPN you did not tick the "Interface mode" option. Unfortunately, you cannot change that after phase1 is created.

My recommendation:

- delete and recreate VPNB completely, in "Interface mode".

- create the routes as needed, you can now specify "phase1name" as the interface

- change the policy's action to "ACCEPT" instead of "IPSEC"

Then, as you have narrowed down the phase2 selector and the policy addresses to a "/32" it's perfectly alright if the VPN only passes traffic from one single host to another (= /32). If you need to connet to several hosts, specify a smaller netmask.

[rwpatterson]

Why the same default gateway on two interfaces?

[flodnar31]

Hi,  

The FortiWiFi is connected on a DSL.

I have an existing VPN which is VPNA and which is working. If I change it to Interface mode will that VPN that is working will go Down?. I don't have physical access to this FortiWiFi.  

Thanks

[flodnar31]

This is the Setup of the FortiWiFi

                                                              |                          | WAN1 <--->VPNA

 172.30.49.177/24  <-->  Software Switch  |   FORTIWIFI 60C | WAN2< --> VPNB

                                                              |                           | DMZ

Is there a way that My configuration will not be changed? Thanks a lot

[ede_pfau]

No, there is no way your configuration remains unchanged when you change your configuration.

If you delete VPNB and recreate it VPNA is not affected. Traffic through VPNA could be affected if you change the routing table, or policies. You should know what you're doing (in terms of networking basics) if you only have remote access.

Make sure you have admin access through either VPNA or directly via WAN1 (even if only during those changes).

[MikePruett]

Make sure you have external administrative access enabled so if you nuke the tunnels you can still hit the device and manage it.