How to bring up the VPN tunnel

[Eastwind]

Iam trying to setup IPSEC VPN between two office, both offices are running the same FG-60, one with OS ver 2.8 the other with OS ver3.0, I followed the article titled Gateway to Gateway IPSec VPN Example, Doc No. is 01-28006-0119-20041022, I used this article to setup IPsec VPN on both unit, but after that how do I bring up the tunnel, I have used Forticlient before, there is a " Connect" button for remote user to connect but I want to creat a VPN connection between two office so where is the " Connect" button, can someone tell me how to bring up the Tunnel. Thanks in advance.

[rwpatterson]

If the tunnels are configured correctly and the policies are in place, they will connect as soon as the proper types of traffic are sent through. In the policies, select ' Log Traffic' . Make sure ping is enabled, then send a ping from one to the other. Next, look into the logs to see why they are not connecting.

[Eastwind]

repatterson, I read another POST saying the article I used has left out important steps something got to do with creating Route - Static . belows are what I get from log access. 1 2007-06-29 22:18:05 notice negotiate Initiator: parsed 61.9.198.89 main mode message #3 (DONE) 2 2007-06-29 22:18:05 notice negotiate Initiator: sent 61.9.198.89 main mode message #3 (OK) 3 2007-06-29 22:18:05 notice negotiate Initiator: sent 61.9.198.89 main mode message #2 (OK) 4 2007-06-29 22:18:05 notice negotiate Initiator: sent 61.9.198.89 main mode message #1 (OK) Is there a more accurate article you can ? Thanks

[rwpatterson]

Under ' Router > Monitor' , tell us what it says in either unit. It should show how to get to the other with a valid route. Also in ' VPN > IPSEC > Monitor' , make sure the indicator for your tunnel is green, not red. Red means the tunnel is down.

[Eastwind]

Bob

ORIGINAL: rwpatterson Under ' Router > Monitor' , tell us what it says in either unit. It should show how to get to the other with a valid route. Also in ' VPN > IPSEC > Monitor' , make sure the indicator for your tunnel is green, not red. Red means the tunnel is down.

Office 1 Router - Monitor reading as below Type Subtype Network Distance Metric Gateway Interface Up Time Static 0.0.0.0/0 1 0 172.18.113.131 ppp0 Connected 172.18.113.131/32 0 0 0.0.0.0 ppp0 Connected 192.168.0.0/24 0 0 0.0.0.0 internal Office 2 Router - Monitor reading as below Type Subtype Network Distance Metric Gateway Interface Up Time Static 0.0.0.0/0 10 0 203.213.108.249 wan1 Connected 10.10.10.0/24 0 0 0.0.0.0 dmz Connected 192.168.1.0/24 0 0 0.0.0.0 internal Connected 192.168.101.0/24 0 0 0.0.0.0 wan2 Connected 203.213.108.248/29 0 0 0.0.0.0 wan1 the indicator in IPSec Monitor is RED SO IT IS NOT working.

[abelio]

Eastwind, you have in your hands one IPSec VPN tunnel (or policy) mode just for the fact you' ve a 2.80 box in one of the sides; forget static routes to establish that vpn type. As Bob said, it just needed traffic between peers to turn up the tunnel. You can force that several ways: . click red arrow (VPN->Ipsec->Monitor) to see if it turns green (up) . configure ' Ping Generator' in 2.80 side (phase2 gui) or " auto negotiate enable" (phase 2 CLI in 3.0 side) Look the logs if vpn doesn' t turns up and if you don' t get something valuable from them, copy & paste it here.

[rwpatterson]

Office 1 Router - Monitor reading as below Type Subtype Network Distance Metric Gateway Interface Up Time Static 0.0.0.0/0 1 0 172.18.113.131 ppp0 Connected 172.18.113.131/32 0 0 0.0.0.0 ppp0 Connected 192.168.0.0/24 0 0 0.0.0.0 internal Office 2 Router - Monitor reading as below Type Subtype Network Distance Metric Gateway Interface Up Time Static 0.0.0.0/0 10 0 203.213.108.249 wan1 Connected 10.10.10.0/24 0 0 0.0.0.0 dmz Connected 192.168.1.0/24 0 0 0.0.0.0 internal Connected 192.168.101.0/24 0 0 0.0.0.0 wan2 Connected 203.213.108.248/29 0 0 0.0.0.0 wan1

Most of us (I believe) configure our tunnels in interface mode. When doing that, you have the option of giving the interface an IP address. When you do this, you can then point a static route between boxes directly. Once you have done it this way, you' ll probably never go back to the policy based tunnel setup again. I haven' t. For example the subnetwork between routers would be 172.16.1.0/29. The IPSEC interface on router 1 would be 172.16.1.1, and router 2 would be 172.16.1.2. From office 1, add a static route of

static, 192.168.1.0/24, distance 1, Metric 1, gateway 172.16.1.2, rtr 1 interface name

From office 2, add a static route of

static, 192.168.0.0/24, distance 1, Metric 1, gateway 172.16.1.1, rtr 2 interface name

Done.