IPSEC VPN with private ip

[wamendoza]

Hi,

I'm setting up a site-to-site IPSec VPN from fortiwifi40f to GCP Google; but I am getting the following error. Delete IPSec phase1 sa, when I check the logs I find that from GCP (Google Cloud Plataform) it tells me that the peer is behind a NAT, because of that it cannot match the public IP in the fortigate. In my FortiGate I have a private IP on the wan interface that the service provider gives me and they manage the public.

Can you help me a bit with this?

[tio3udes · Accepted solution]

Your problem here is that you need to set up a dial up vpn as only the GCP side of the connection have a public IP, so only it can start up the tunnel.

Set up the dial up tunnel and then try to route traffic from GCP side, through the tunnel. It should bring the vpn up.

Also, i've found these links that might help you.

https://cloud.google.com/community/tutorials/using-ha-vpn-with-fortigate

https://www.youtube.com/watch?v=QWsd0qcZdgA

Another solution would be using DDNS:

https://www.fortinetguru.com/2017/10/ipsec-dynamic-dns-configuration/

[wamendoza]

Hi,

Thank u very much, really this solution, i had thought but i was not sure.

Really, thank you.