IPSec Tunnel Won't connect to remote fortigate

[Clubinski25]

I configured an IPSec tunnel to access my home server through Fortigate 60D. The forticlient will connect while on my home lan but when i try to access outside my home LAN it does not connect. Can anyone assist please?

[hubertzw]

Did you configure all destination IPs in the selectors? Do you have firewall policy for this traffic?

[Clubinski25]

I am not sure what you mean by the destination IPs in the selector. This is a snap of the Policy for the Tunnel.

Please advise,

[hubertzw]

You showed policy with destination interface 'internal'. If the resource is accessible via different interface you need a separate policy.

Selectors - this is how you define what traffic should be sent to the tunnel. If you specify destination for example 10.0.0.0/24, you can't send traffic to 10.1.0.0/24. Verify your VPN settings (phase2).

[Clubinski25]

The internal is what i want to be able to access via VPN. Phase 2 was not configured on the tunnel. Internal - 10.0.5.0/24 I converted it to a custom tunnel and changed the following; Remote gateway - dialup User Specified client range = 10.0.10.100 - 10.0.10.200 Phase 2 selectors Local address - Local Lan (internal interface) Remote addredd - IPSEC VPN range

[rwpatterson]

Clubinski25 wrote:
The internal is what i want to be able to access via VPN. Phase 2 was not configured on the tunnel. Internal - 10.0.5.0/24 I converted it to a custom tunnel and changed the following; Remote gateway - dialup User Specified client range = 10.0.10.100 - 10.0.10.200 Phase 2 selectors Local address - Local Lan (internal interface) Remote addredd - IPSEC VPN range

Best of my knowledge:

Remote gateway - dialup User                        (outside IP address of the remote gateway/concentrator) Specified client range = 10.0.10.100 - 10.0.10.200 Phase 2 selectors Local address - Local Lan (internal interface)    (Same range as the client range) Remote addredd - IPSEC VPN range                (the subnet that you need to reach on the remote side)

[Clubinski25]

rwpatterson wrote:

Clubinski25 wrote:
The internal is what i want to be able to access via VPN. Phase 2 was not configured on the tunnel. Internal - 10.0.5.0/24 I converted it to a custom tunnel and changed the following; Remote gateway - dialup User Specified client range = 10.0.10.100 - 10.0.10.200 Phase 2 selectors Local address - Local Lan (internal interface) Remote addredd - IPSEC VPN range

Best of my knowledge:

Remote gateway - dialup User                        (outside IP address of the remote gateway/concentrator) Specified client range = 10.0.10.100 - 10.0.10.200 Phase 2 selectors

Local address - Local Lan (internal interface)    (Same range as the client range) Remote addredd - IPSEC VPN range                (the subnet that you need to reach on the remote side)

I did Change the "Remote Gateway" to my ISP IP which did not work , I  have it current set to the IP of the Fortigate. When I change it from dialup user to "static IP" the Phase 2 selectors disappear and it does not allow me to set the Local Address & Remote address.

Hope this helps

[hubertzw]

Clubinski25 wrote:
Phase 2 selectors Local address - Local Lan (internal interface) Remote addredd - IPSEC VPN range

You can add more addresses as a local. It allows you to reach the remote subnet. I don't know how you reach that additional subnet (from the FTG) but you need a firewall policy for it.

The host/server in the remote subnet should know how to reach VPN users. Make sure the routing is correct.

[Clubinski25]

I double checked this and matched above settings and still not connecting the IPSEC VPN off my local network. 

Any more suggestions?

[sw2090]

hm you wrote you can connect to your vpn from your lan but no from outside (even if you set the isp as remote gw on your forticlient). Unfortunately you didn't provide one important detail:

How is your FGT connected to the internet? Does the FGT do dialup with pppoe? Or does it even have static isp ip on an interface? In this case it should work.

Or do you have a router in front of your FGT that does the connection to your isp and the wan side of the FGT is just connected to it. In this case you need to do some portforwarding on your router. You will need the ports 500/UDP (IPSEC itself) and probably 4500/UDP (NAT-Traversal if you use it) forwarded to your FGT.

hth

Sebastian