IPSEC VPN to transparent mode unit

[Lucascat]

Hi all,

is it possible to setup an IPSEC VPN between this units:

unit A: Fortigate 60d 5.2.8 - nat mode

unit B: Fortigate 50b 4.3.18 - transparent mode

Any help is appreciated.

L

[ede_pfau]

Yes, that's possible. This is one of the RARE situations in which you need to create the IPsec VPN in "policy mode" (as opposed to "interface mode" or "route mode"). For this, you define the VPN parameters as usual but in Phase1 you make sure to tick "policy mode".

Then, the access policy's action needs to be "IPSEC" instead of "ACCESS".

For all the relevant details please look up "IPsec VPN" in the Reference Guide.

[MikePruett]

Ede hit the nail on the head. Policy based IPSec tunnel creation on the transparent device will enable this to function as you need. Please note that any device that is upstream (ASA firewall or other security device) will need the proper ports and protocols open to allow the transparent device to build the tunnel through it.

[Lucascat]

Thank you Ede, but on 5.2.8 I don't find "policy mode" when I create VPN (gui).

Perhaps it is possible only using CLI?

L

[MikePruett]

You create a custom IPSec tunnel (uncheck "interface mode" when doing so on the Phase1)

You then create a policy from inside network to wan1 (or whichever is your outside port) and under action define "IPSEC" from here you can define which tunnel to utilize.

[ede_pfau]

@Lucascat:

go to 'System' > 'Config' > 'Features'

click 'Show more' at the bottom

enable 'Policy based VPN'

In 'VPN' > 'Tunnels' , select 'create new', 'Custom tunnel'

now you see 'Interface mode' enabled at the top; uncheck this option and proceed with filling in the parameters.

[Lucascat]

Thank you Ede.

I forgot to mention that the 50b (transparent mode) is behind a NAT router, so which IP I have to specify while defining VPN on the 60d (which have instead a public IP :) )?

The public IP of the router? Or the private IP of the 50b management interface?

[ede_pfau]

There are 2 ways to handle this:

1- use the public IP of the NAT router

in this case, you need to forward ports udp/500 and udp/4500 from the router to the FGT. NAT-T has to be enabled on both VPN gateways.

2- you let the FGT behind the NAT router initiate the tunnel, with auto-negotiate on. The other VPN gateway needs to be configured for "dial-in" VPN. This way, you can even handle the case where the ISP assigns private IP addresses...