Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fortimaster
Contributor

IPSEC Tunnel doesn't match user in incoming traffic.

Hi all,


I have create an IPSEC dial up tunnel with Ike v2 and NAT-T. I use Forticlient to connect to it and it works well. 

 

I have observed that some traffic are denyed cause when I send traffic across the tunnel, the user with witch Im logged (using forticlient) is not associated with the incoming traffic. I can see the IP from the private tunnel network but not the username. That causes the incoming traffic matches a deny policy, cause I use an user group in the incoming rule that permits traffic from the IPSEC interface. For example, I can see traffic from 192.168.106.x but the incoming traffic has not an user associated.

Why the username with witch Im connected to the tunnel are not matched in incoming traffic?

I attach you the tunnel configuration:

one.JPGtwo.JPG

 

Thanks ¡¡¡

 

1 Solution
hbac

@fortimaster,

 

Yes, it is a limitation because "inherit from policy" doesn't exist when using IKEv2. You can submit a new feature request for it if you want. 

 

Regards, 

View solution in original post

12 REPLIES 12
fortimaster

Hi hbac. Ikev2 is recommended whenever possible. Could you confirm me that with this protocol I have that limitation? I am surprised cause I thought that Ikev1 is an evolution of ikev2.

hbac

@fortimaster,

 

Yes, it is a limitation because "inherit from policy" doesn't exist when using IKEv2. You can submit a new feature request for it if you want. 

 

Regards, 

fortimaster

Thanks hbac. I will do different tunnels to solve that limitation. Thank you very much for your help ¡

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors