IPSEC IN to OUT

nikolaj · ‎02-02-2017

Hello,

I am not very practice with Fortigate and I am analyzing the company firewall policies, so I would like to know the meaning of the policies in the attached file.

The direction of the policies is IN >> OUT

Thank you

--

Nicola

MikePruett · ‎02-07-2017

You only need a policy to allow traffic from the initiator. So if devices behind FortiGate A are going to be initiating traffic you would have

FortiGate A: INSIDE to VPN policy for traffic to flow

FortiGate B: VPN to INSIDE policy for traffic to come through

from there the reverse traffic will come back due to the session tables knowing they are the return traffic to that initial communication.

Mike Pruett

Fortinet GURU | Fortinet Training Videos

View solution in original post

nikolaj · ‎03-29-2017

It's correct to say that if the Fortigate external interface IP address (on both ends of site-to-site tunnel) is a public address, does not need to use Nat-traversal?

ede_pfau · ‎03-29-2017

Yes, correct.

Ede

"Kernel panic: Aiee, killing interrupt handler!"

nikolaj · ‎03-30-2017

And what if only one of the two ends of the tunnel is behind a NAT?

ede_pfau · ‎03-30-2017

Then you need to enable NAT-T on both ends. What it does is that instead of using protocols AH and ESP in the clear they are wrapped in UDP (ports 500 and 4500) which can be NATted. AH and ESP do not use ports, so no port translation.

Ede

"Kernel panic: Aiee, killing interrupt handler!"