Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Lucascat
New Contributor III

IPSEC VPN to transparent mode unit

Hi all,

is it possible to setup an IPSEC VPN between this units:

unit A: Fortigate 60d 5.2.8 - nat mode

unit B: Fortigate 50b 4.3.18 - transparent mode

 

Any help is appreciated.

L

7 REPLIES 7
ede_pfau
SuperUser
SuperUser

Yes, that's possible. This is one of the RARE situations in which you need to create the IPsec VPN in "policy mode" (as opposed to "interface mode" or "route mode"). For this, you define the VPN parameters as usual but in Phase1 you make sure to tick "policy mode".

Then, the access policy's action needs to be "IPSEC" instead of "ACCESS".

For all the relevant details please look up "IPsec VPN" in the Reference Guide.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
MikePruett
Valued Contributor

Ede hit the nail on the head. Policy based IPSec tunnel creation on the transparent device will enable this to function as you need. Please note that any device that is upstream (ASA firewall or other security device) will need the proper ports and protocols open to allow the transparent device to build the tunnel through it.

Mike Pruett Fortinet GURU | Fortinet Training Videos
Lucascat
New Contributor III

Thank you Ede, but on 5.2.8 I don't find "policy mode" when I create VPN (gui).

Perhaps it is possible only using CLI?

L

MikePruett
Valued Contributor

You create a custom IPSec tunnel (uncheck "interface mode" when doing so on the Phase1)

 

You then create a policy from inside network to wan1 (or whichever is your outside port) and under action define "IPSEC" from here you can define which tunnel to utilize.

Mike Pruett Fortinet GURU | Fortinet Training Videos
ede_pfau

@Lucascat:

go to 'System' > 'Config' > 'Features'

click 'Show more' at the bottom

enable 'Policy based VPN'

 

In 'VPN' > 'Tunnels' , select 'create new', 'Custom tunnel'

now you see 'Interface mode' enabled at the top; uncheck this option and proceed with filling in the parameters.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Lucascat
New Contributor III

Thank you Ede.

I forgot to mention that the 50b (transparent mode) is behind a NAT router, so which IP I have to specify while defining VPN on the 60d (which have instead a public IP :) )?

The public IP of the router? Or the private IP of the 50b management interface?

ede_pfau

There are 2 ways to handle this:

 

1- use the public IP of the NAT router

in this case, you need to forward ports udp/500 and udp/4500 from the router to the FGT. NAT-T has to be enabled on both VPN gateways.

 

2- you let the FGT behind the NAT router initiate the tunnel, with auto-negotiate on. The other VPN gateway needs to be configured for "dial-in" VPN. This way, you can even handle the case where the ISP assigns private IP addresses...

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors