IPSEC VPN on private IP Fortigate WAN w/Fortiextender not coming online

[demetriusaustin]

Trying to get this configuration sorted out for to successfully establish an IPSEC VPN tunnel using the following hardware:

[ul]

AT&T hotspot w/public IP address

Fortiextender 100b into the WAN port with a private IP of 10.100.1.110

Fortiwifi 30d w/internal interface set to private IP of 10.1.13.211 & DHCP enabled w/10.1.13.110-200[/ul]

Remote endpoint for the tunnel is a VMWare Edge server and the remote tunnel is already set up to allow traffic from the public IP address and private peer of 10.1.13.0/24.

I have created the VPN local endpoint as well, bot Phase I and Phase II.

Policies are in place for all interfaces including the FortiExtender, but the tunnel will not come online. I can imagine this is likely due to something missing in the configuration:

[ul]

There is likely some NAT'ing that I am missing

Maybe a policy or two that I am missing[/ul]

NOTE: All devices behind the firewall will be connected via the LAN interface on the 10.1.13.x subnet.

[ede_pfau]

Well then, post the port configs (text only, please).

The port the FEX is on needs to be "dedicated". As soon as the port detects a FEX this option is offered in "conf sys int".

You then ignore the WAN  port in your policies; only the virtual port the FEX tunnel is symbolized by is used. IIRC the name of the port is predefined by FOS.

Regarding NAT: the FEX would need to receive a public IP address and traffic destined to "WAN" (not the WAN port, but the FEX virtual port) would have "NAT" checked.

[demetriusaustin]

@ede_pfau thanks for the response.

Just so you are aware and sorry I didn't make it clear in the original post, the fext_wan1 interface is dedicated and I have a policy for it. You are correct in that the WAN port doesn't matter because the virtual port is dedicated to WAN traffic.

Is there anyway to successfully configure the tunnel with only the hotspot/modem having a public IP address in this scenario? Inquiring because I have had a hell of a time with AT&T to even get the initial public IP address even after I mentioned to them to NOT assign it to the modem. I am more than 12hrs into phone conversations with incredibly "intelligent" people and I was hoping I could get the tunnel up without having to continue down the road of either getting the current IP address removed and/or a second IP address added.

[ede_pfau · Accepted solution]

I'd say yes, a dial-out IPsec VPN should be possible. If the remote FGT dials into the HQ FGT traffic would need a public source address for routing but the tunnel would not need to rely on it. Instead, you use Aggressive mode with peer IDs.

This is well documented in the Cookbook, or, if you can, use the IPsec VPN wizard in FOS v5.2.

[demetriusaustin]

Thx ede_pfau Your response is the only way to go with this configuration as is.