Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Fortigate Firmware version 4 MR2 with Cisco ASA Firmware 8.2.1 Thank1st off your digram and cfgs where a big help. 2nd why do you have vpn define as both a phase1/2 and phase1/2-interface? 3rd, I think you problems resides around the set nat enabled on the firewall policys at the FGT side. You don' t need this enabled. I would do the following ; delete these edit 2 set srcintf " internal" set dstintf " wan1" set srcaddr " Local_LAN" set dstaddr " Remote_LAN" set action ipsec set status disable set schedule " always" set service " ANY" set logtraffic enable set inbound enable set outbound enable set vpntunnel " FGTtoASA" and then I would stay with interface and route-mode vpn, so delete this; config vpn ipsec phase1 edit " FGTtoASA" set interface " wan1" set keylife 86400 set proposal 3des-sha1 set dpd disable set remote-gw 192.168.0.6 set psksecret ENC oeX+CO11kI1yYtnP2dzvZwSGdNbXQvg1hxf1h0CqalxBn1U0mwBSrkLk1Ifc9pfCWb2o4eFcK6vEpa8vZu176oEXaBIEaFTmdK9T+0FAyh8ci+sf next end config vpn ipsec phase2 edit " FGTtoASA2" set dst-addr-type name set keepalive enable set phase1name " FGTtoASA" set proposal 3des-sha1 set replay disable set src-addr-type name set dst-name " Remote_LAN" set keylifeseconds 28800 set src-name " Local_LAN" next end next I would clean up the other firewall policies; edit 3 set srcintf " internal" set dstintf " FGTtoASA_IN" set srcaddr " Local_LAN" set dstaddr " Remote_LAN" set action accept set schedule " always" set service " ANY" set logtraffic enable unset nat enable next edit 4 set srcintf " FGTtoASA_IN" set dstintf " internal" set srcaddr " Remote_LAN" set dstaddr " Local_LAN" set action accept set schedule " always" set service " ANY" set logtraffic enable unset nat enable next That would clean up he FGT side of things. On the cisco side it looks okay but I don' t think Name and using 60.0.0.0 and 50.0.0.0 is going to work. You should use the proper group-object Something like this; object-group Local_LAN network-object 60.0.0.0 mask 255.255.255.0 object-group Remote_LAN network-object 50.0.0.0 mask 255.255.255.0 Outside of the above, that would clean up things.
PCNSE
NSE
StrongSwan
Do you have rules allowing traffic in both directions? You need to have firewall rules that allow traffic from Cisco side to Fortigate side, and then from Fortigate side to Cisco side. Also, ensure NAT is disabled in your rules.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.