IPSec tunnel options - help!

[mlfrohlich]

Hi, I have a Fortigate 60F and need to create an IPSEC tunnel to a non-Fortigate device.   My problem though is that there is an existing router in my way.  I'm unable to remove the router and I can't get into the settings of it.   It's needed for the ISP's mesh wi-fi setup I am told.     

1. Can i place the Fortigate on the internel network and have it negotiate the tunnel?  I don't think it would get the traffic.

2. Put the Fortigate at the edge in transparent mode and establish the tunnel?   It doesn't have any L3 addressing so not sure that's possible.

3. Double NAT?  yikes

[dingjerry_FTNT]

Hi @mlfrohlich ,

I guess that you can get DHCP IPs(192.168.1.0/24 network) from the router, correct?  

If so:

1) Put the FGT behind the router so WAN interface on FGT can receive DHCP IP or you assign one 192.168.1.x/24 IP if you know what router's internal IP (it must be 192.168.1.y/24 as well) is.

2) On FGT, create a default static route via WAN interface, Gateway is 192.168.1.y

3) On FGT internal interface, create a DHCP server, configure a different subnet than 192.168.1.0/24 so you can dispatch DHCP IPs to the internal network;

4) Create an IPSec VPN, and enable "Nat Traversal" in phase1 settings.  FGT has to initial to bring up the IPSec VPN since you do not have access to the router to configure port forwarding.  Otherwise, the remote peer can bring up the tunnel by accessing the router's external IP and the router can port forwarding to the FGT WAN interface for IPSec IKE traffic.

[sw2090]

the problem is imho that the fortigate tries to establish the ipsec but it cannot get any response from the peer because of the router. It would work if the FGT hat an interface connected to th same subnet the peer is in. But I guess that is an ipsec over the internet is it?

The problem is that PSec traffic uses Port 500/udp (and switches to 4500/udp if NAT-T is enabled) and this hits the router because if over internet the peer can only have the router wan ip as remote gw. If then there is no portforwarding on the router you won't get no ipsec communication.

[dingjerry_FTNT]

Then you may consider put the FGT in front of the Router.

[mlfrohlich]

Thanks for taking the time to respond.   If I did this I believe I'd run into a double NAT situation and I'm not sure I want to do that.

After checking with the ISP again, it appears they might be able to do some port forwarding for me, but the won't disable the routing function on the current box for me.    I've never setup an IPsec tunnel with the FW on the LAN.   if I have the ports forwarded to the FW, then I just set it up as normal or do i need to choose some specific type such as policy based?

[dingjerry_FTNT]

Hi @mlfrohlich ,

As normal. In IPSec Phase1 settings, FGT uses WAN interface IP as the local gateway.  On Remote peer, pointing to the Public IP on the Router.