Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Help.. Fortigate setup in GCloud not working

Good afternoon and please forgive me for dumb questions. In my defense, this is my first venture into Fortigate so this might be a simple issue to fix. 


I have a tunnel coming in that is being nat'd. I have created vips for my 10.10.x.x nodes that the remote end needs to connect to. I can ping those nodes from the fortigate to the nodes nat and internal ip. I am using their nat ips as the encryption domains since these are the only 3 nodes they need to get to from the remote. Phase 1 is up and phase 2 is up. I've allowed the traffic on the gcloud firewall and the fortigate. Everything seems to be routed right. Am I missing something? For example, my Peer ip (Not really, but an example. My encryption IDs are from the VIPs I created on the fortigate of, .6, and .8. I've mapped these to the 10.10.x.x address of each node. Am I missing something? I've looked at documentation and it appears that it's correct. Any and all help is appreciated. 


Could you please share the exact issue? Are you not able to reach the remote subnet?

You can also collect the sniffer log

diagnose sniffer packet any 'host local_IP and host remote_ip' 4 0 l

Mrinmoy Purkayastha

Thanks for responding. I spun up a fortigate appliance in GCloud. I have multiple tunnels coming in and only need to touch two load balancers. Those IPs are and I've assigned them virtual nat ips from the appliance or and I can ping these external ips from the appliance and can ping the appliance from the servers with the nat ips. 


I've made these IPs along with one another my encryption domains, and the remote host cannot hit them. Everything appears to be setup properly. phase 1 and phase 2 are up. 


Hey raydietz,

so, I have very little experience with Google Cloud, but if I understand correctly:

- you've set up two VIPs on FortiGate (virtual nat IP), with external IP, and translating those to internal IPs and

- the load-balancers ( and can ping the public IPs hosted on FortiGate

- a remote host can ping, but this does not translate to the internal IPs


If my understanding is correct, then you probably need to add a firewall policy on FortiGate, with roughly these settings:
source interface: IPSec tunnel interface? wherever traffic comes in to reach the loadbalancers

destination interface: egress to the load-balancers

source address: any

destination address: the two VIP objects

-> you need to put the VIPs into a firewall policy for FortiGate to accept and translate the traffic properly




+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++

Thanks for relying Deborah,

You are correct. I did add the rule with no success. I can ping the endpoints. I can't seem to get the traffic to flow over the tunnel in either direction. Phase 1 is up Phase 2 isn't but settings match on both sides. Do I have my encryption domain setup wrong? it is a /32 address, so I am wondering how that routes to two nat addresses.



Hello raydietz,


Could you please share the outputs from the ike debug. This should show us if there is a mismatch for the encryption/hashing algorithms used.


diagnose vpn ike log-filter dst-addr4 [remote-peer]
diagnose debug application ike -1
diagnose debug enable

Technical Support Engineer,

I've confirmed no mismatches. I think it is routing or something related. I guess my question is this.. How do I set up my natted encryption domain of (example) to pass traffic through to my 10.x networks within the vpcs? I have 4 subnets I need that address to pass traffic through to the nodes without subnet overlap. 



Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors