Fortigate 30E / Unable to setup VPN: Duplicate remote gateway / FW v5.4.1 Build 1064

[p_kohn]

Hello,

my name is Philipp, I'm new in the FortiGate Firewall environment, but I like the new OS 5.4 really. 

In the past I've worked a lot with Dell Sonicwalls so NGFWs are not new to me.

My actual problem is, we have a customer with an old Zyxel USG 100 device with 2 VLANs, one for the production Environment and one for the Virtualization Host & Management.

For Support and maintenance reasons we need to have an IPSec to both VLAN Subnets. In our Branche Office we have a Fortigate 30E and in our HQ an Fortigate 100D, we have to create the Tunnel from all our offices to the customer. 

The Zyxel Device is not able to route 2 subnets through one IPSec, and the Fortigate 30E (FW 5.4.1) is blocking me to make a second IPSec with the error "Unable to setup VPN: Duplicate remote gateway."

Can we add 2 subnets into the local or remote policy in one VPN connection?

http://kb.zyxel.com/KB/se...Oid=012579&lang=EN

I know that the old Zyxel is a piece of ****, and we're look forward to change the product, but for now we have to live with it, so perhaps someone has a workaround for my problem. 

Thx

Philipp from Germany

[Toshi_Esumi]

I think you just need to add as many phase2-interfaces as you need (I don't have 30E to confirm but at least 100D should have the capability) to the existing phase1-interface, but I just realized 5.4.1 doesn't seem to have GUI interface to create more than one (I tested FWF60D). I'm afraid you have to use CLI. If you haven't done any CLI yet, you need to learn how to via manuals or just google them. It should look like below. Once you create it, it would show up in GUI.

config vpn ipsec phase2-interface     edit "test-vpn1-1"                         <- created by GUI         set phase1name "test-vpn1"         set comments "VPN: test-vpn1 (Created by VPN wizard)"         set src-subnet 192.168.10.0 255.255.255.0         set dst-subnet 10.0.0.0 255.0.0.0     next     edit "test-vpn1-2"                         <- I added via CLI         set phase1name "test-vpn1"         set src-subnet 172.16.100.0 255.255.255.0         set dst-subnet 10.0.0.0 255.0.0.0     next end

[Toshi_Esumi]

Ah, you need to hit "Convert to Custom Tunnel" to see the option to add multiple phase2s.

[ede_pfau]

@Toshi:

I think the problem is that the Zyxel doesn't route 2 subnets across the tunnel. No question the FGT can do this.

As a suggestion - but that depends on the Zyxel capabilities: source NAT one subnet onto one address/multiple addresses of the other subnet which you then route over the tunnel. (one example why NAT sometimes is called 'poor man's routing').

[Toshi_Esumi]

Yeah, I misread. I assumed you were trying to replace the Zyxel to FG30E. I agree with ede_pfau, natting is the first option. FG would not allow two different tunnels to the same peer IP.

If that's not even an option, you might need to split traffic between two subnets to get to your dirrenet branch offices then specifically route through the branches inside of your network. Probably you need to change the way of routing in your organization significantly. I guess this is outside of this forum.

[p_kohn]

Hi,

sorry for my late answer, we've discussed the situation internally. We will decommision the VLAN Situation at the customer Site because it is not really needed.

Thx for your Support

Regards Philipp