Fortigate30b: IpSec VPN between two public ip addresses?

[#1]

Hello to everybody in this forum. I read your advices everyday but it' s the first time for me to interact here with you. I checked some previous posts that talk about IpSec between two public ip addresses but I can' t solve my problem and I am a bit confused. Hope that somebody can help me, I would be so pleased.... I have a fortigate30b and I need to nat all traffic behind my public address. I am trying to set up a VPN tunnel between my Fortigate30B and another firewall/server (I don' t know much about it, it is managed by other guys). In the past I always have setup VPNs between private ip addresses and this time I am not able to obtain a good result with 2 public ip addresses. My fortigate30b is behind a router and I need to set up a VPN tunnel between my public Ip address and theyr public Ip address. The VPN is up in the status monitor, I can ping theyr firewall public Ip but I am not able to telnet theyr Ip. I tryed to change the configuration but the guys tell to me that I am always tring to connect with them from my subnet 10.1.1.0/24 and thtat will never work because they need a Public Ip form my side. they don' t allow tunneling to my private network. They also wrote to me that my error is about: IKE: Quick Mode Completion; IKE IDs: host: xxx.firewall-guys-host-Public-Ip.3 and subnet: 10.1.1.0 (mask=255.255.255.0) while the guys told to me to change in: IKE: Quick Mode completion; IKE IDs: subnet: xxx.guys-net-Public-Ip-.0 (mask=255.255.255.192) Any advices? Please help me!

[#2]

Last news. I am able to ping them and they are able to ping me, the VPN is up in the status monitor but there is still the same problem: they say that I am trying to connect with them from my subnet 10.1.1.0/24 and not from my Public Ip Address. What can I do? I am checking in the FortiOS Handbook but I am not able to solve the problem. In this handbook I can read only configuration between Ip private address and public Ip address so I am a bit confused. Question: Is it possible to setup a VPN between two public Ip addresses with Fortigate30b? Or I need to change Firewall?

[#3]

As written in the FortiOs Handbook, in the phase 1 configuration I have had the opportunity to choose a static IP address for the remote gateway (the stati Ip public address of the guys). But I can' t understand where I can select a static public IP address also for the other side of the tunnel, mine side. I move to Phase 2 setting and I try to change in the quick mode selector my source address from 0.0.0.0/0 to my public Ip address. But without good results.

[Maik]

not sure what exactly you want to achieve. But from my understanding, the goal of a VPN is that you don' t need to connect with the Public IP' s. The goal usually is to connect two private networks (Your private IP and their private IP) together. In phase2 you define as quick mode selector what the trusted subnets are (others call that encryption domain). From what I understand is that you are currently doing it right and there might be a misconception/understanding on the other end? maybe we need a 10000ft view: what you want to access on their end?

[#5]

Maik, thank you so much for your answer. I confirm that I am so confused also to write my problem, please sorry me. I just talked with the guys on the other side and they say to me that the problem is that I am not able to nat all my flow. They ask me that I need to nat all the flow and that everything come from my public Ip address. I report the text message: You have to nat all traffic behing your public IP address. Now you are trying to connect from the subnet 10.1.1.0/24 and that will never work. Maik, I don' t want to abuse your patience, but how could I nat all the traffic behind my public Ip address?

[Maik]

Maik, I don' t want to abuse your patience, but how could I nat all the traffic behind my public Ip address?

In case you built your tunnel in Interface mode, you would do the following: create an IP Pool with your Public IP. Choose the Firewall policy with the VPN Interface as destination in this policy tick NAT and choose the IP Pool with the public IP. but, this will not work as expected: the packet will arrive on the remote end with your public IP as source. the answer to this packet will choose the public IP as destination. the routing of the remote firewall will send the answer directly through the Internet instead of the VPN tunnel. the fortigate will drop the answer as its arrives from the wrong are (internet instead of VPN tunnel)

[rwpatterson]

You could do this if you don' t use the peer IP as the NAT IP. Use some other IP from your public subnet and have the vendor force that IP through the tunnel. That will work.

[#8]

Second text message is: Now there is: IKE: Quick Mode Completion; IKE IDs: host: xxx.xxx.150.3 and subnet 10.1.1.0(mask=255.255.255.0) you need to change to IKE: Quick Mode Completion; IKE IDs: subnet: xxx.xxx.151.0(mask=255.255.255.192) where xxx.xxx.150.3 is the guy' s firewall and where xxx.xxx.151.0 is the guy' s netowrk range. But I can' t understand where I need to change in the admin panel.

[Maik]

hum, i think i start to understand. other guy is using a Lancom device. he seems to be using a public IP range as Internal/Private subnet. this he adds as the IKE ID' s (Quickmode selectors). the IKE IDs: host is his actual public IP he got assigned by his ISP. this is a different IP Range than his itnernal net (mask 255.255.255.192) when he sticks on this public ip as private range, you could try following: just " invent" a public subnet which has nothing to do with your internal network. define a VIP with an IP range that maps those public IP' s to your Internal range. assing this VIP in a policy (Source VPN Interface, destination your internal network). but this is crap... but maybe makes them happy

[rwpatterson]

but this is crap... but maybe makes them happy

No lie there.... What hoops we have to jump through....