IPsec VPN Multi VDOM - Remote Access From Windows Native VPN

[Andrew_C]

I am new in FortiGate firewall (60F) and I am trying to create a remote access from Windows native VPN using an IPSec VPN settings on FortiGate. Below are the current settings on 60F.

- 3 VDOM (root, A & B)

- root VDOM has 2 wan interface and has SDWAN setup for failover

- A & B must through root VDOM to have internet access

- Both A & B has VDOM link to connect to root VDOM

How to setup an IPSec VPN remote access on 60C so that users can use Windows native VPN client to remote access servers in VDOM A ? Please assist me on how to get this work, Thanks.

[akushwaha]

Hi@Andrew_C ,

Please go through the below article to configure L2TP VPN on FortiGate :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-establish-VPN-connection-between-Wi...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-connect-Windows-10-client-to-L2TP-V...

Best regards,
Abhimanyu

[Andrew_C]

Dear akushwaha,

How to establish the ipsec from wan to vdom A through root vdom ? root vdom is a management vdom and all wan interfaces are managed by it. Thanks.

[nweckel]

Hi Andrew_C

You need to create a vdom link between vdom root and vdom A. And create policies to allow traffic from vdom link to WAN and from WAN to vdom link.

You can find a sample configuration in the article below:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-IPSec-VPN-tunnels-on-VDOMs-tha... 

And for L2TP over IPsec configuration:

https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/386346 

[Andrew_C]

Dear nweckel,

I had already created a vdom link (10.0.0.1 / 10.0.0.2) between them and also created a "Native L2TP/IPsec" in vdom A for Windows using the vpn template. I also created two policies in root vdom to allow in & out of the vdom link to WAN and also created VIP (IP Mapped from WAN to vdom link A - 10.0.0.2). The problem is the ipsec traffic cannot pass through root to vdom A.

[Toshi_Esumi]

Please show us the root interface, vdom-link interfaces (both root and A sides) config, VIP config, and policlies in the root vdom.

Toshi

[Andrew_C]

root interface:

config system interface
edit "wan1"
set vdom "root"
set mode dhcp
set allowaccess https ssh
set type physical
set role wan
set snmp-index 1
config ipv6
set ip6-mode dhcp
set ip6-allowaccess https ssh
end
next
edit "wan2"
set vdom "root"
set mode dhcp
set allowaccess https ssh
set type physical
set role wan
set snmp-index 2
config ipv6
set ip6-mode dhcp
set ip6-allowaccess https ssh
end
next
edit "internal1"
set vdom "root"
set type physical
set snmp-index 4
next
edit "internal2"
set vdom "root"
set type physical
set snmp-index 5
next
edit "internal3"
set vdom "A"
set ip 172.20.20.254 255.255.0.0
set allowaccess ping https ssh
set type physical
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 6
config ipv6
set ip6-allowaccess ping https ssh
end
next
edit "root--A0"
set vdom "root"
set ip 10.0.0.1 255.255.255.252
set allowaccess ping
set type vdom-link
set snmp-index 26
config ipv6
set ip6-allowaccess ping
end
next
edit "root--A1"
set vdom "A"
set ip 10.0.0.2 255.255.255.252
set allowaccess ping
set type vdom-link
set snmp-index 27
config ipv6
set ip6-allowaccess ping
end
next
edit "IPsec--Windows"
set vdom "A"
set type tunnel
set snmp-index 32
set interface "root--A1"
next
end

config system vdom-link
edit "root--A"
next
edit "root--B"
next
end

VIP and Policies in root vdom:

config firewall vip
edit "IPsec-VPN--A"
set uuid ca48745e-a2fa-51ee-8cc4-a6d09d77c55f
set extip 192.168.123.144
set mappedip "10.0.0.2"
set extintf "wan2"
next
end

config firewall policy
edit 4
set name "A--IPsec-VPN_IN"
set uuid 393beb98-a008-51ee-3041-7d638092cab8
set srcintf "Dual_WAN"
set dstintf "root--A0"
set action accept
set srcaddr "all"
set dstaddr "IPsec-VPN--A"
set schedule "always"
set service "IKE"
set logtraffic all
set nat enable
next
edit 5
set name "A--IPsec-VPN_OUT"
set uuid 0fbd4112-a081-51ee-b368-e72a464d1e98
set srcintf "root--A0"
set dstintf "Dual_WAN"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "IKE"
set logtraffic all
set nat enable
next
end

[Toshi_Esumi]

IPSec-inbound(destined to 192.168.123.144)-->wan2:192.168.123.144(pulled via DHCP)---[VIP-A to 10.0.0.2]--->root-A0[root]/-A1[A](10.0.0.2/30)

Then the policy with the VIP-A is allowing IKE only.

I'm assuming "Dual_WAN" is a zone with wan1 and wan2.

With this IKE attempts coming in should be forwarded to root-a1. If you sniff on the interface, you should be able to see those packets. But once the initial negotiation is done and packets started getting encrypted, those won't get to root-a1 any more.

Below is a KB for local-in policies but it explains what services are involved in IPSec.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-port-forwarding-using-FortiGate-...

So, you need to allow "ESP" as well.
But you should sniff on the interface like "diag sniffer packet root-a1 'host <source_IP>'" to see what's arriving or what's not on VDOM A side.

Toshi

[Andrew_C]

Dear Toshi,

Dual_Wan is a zone of SDWAN included wan1 & wan2 and I don't understand --> (IPSec-inbound(destined to 192.168.123.144)-->wan2:192.168.123.144(pulled via DHCP)---[VIP-A to 10.0.0.2]--->root-A0[root]/-A1[A](10.0.0.2/30)). The policy in root vdom for IPsec inbound like below ?

Incoming Wan2 -- Outgoing root-A0 -- Destination VIP (Wan2 to root-A1) -- Service IKE & ESP

Also, it has two policies automatically added in vdom A after create the windows native tunnel using the template and does it need to  add a static route in vdom A ?

Because I'm new for fortigate, please guide me to do this. Thanks a lot.

[Toshi_Esumi]

I just put your config in a sequence. At this moment, since you said the VPN access packets don't get to root-a1 (VDOM A side) interface, I'm concerning on root vdom config.

My concern now is if the IP:192.168.123.144 that wan2 pulled and you configured in the VIP is a real IP or dummy. If real, the client side can't reach it over the internet since it's a private IP.

If your ISP is handing the private IP, they have NAT in the upstream or at the GW device. So unless the ISP can set a VIP similar to yours toward 192.168.123.144 (has to be "static" IP over DHCP), the clients can't get to your FGT's wan2 over the internet.

Or, is it just a dummy to hide your real public IP? Then at least client's attempts should hit the root-a interface. Don't you see anything in sniffing I posted before?

Toshi