IPsec VPN - Starlink to Fortigate

[denji0]

Hi.

The staff member of a client of ours who has a 60E Fortigate with the latest 6.2 firmware, is trying to connect from his new home, which uses a Starlink connection. If we use the Starlink connection, we cannot connect at all to the Fortigate, but if we tether to a Mobile 4G connection or similar, it works fine, as does the same credentials from a Fibre connection.

TIA for any insight into what might be happening.

[srajeswaran]

Are you able to ping the Fortigate interface via starlink?

[rtichkule]

Hello,

The issue with the Fortigate not working when connecting via a Starlink connection probably related to connectivity issues through your ISP.

Please attempt to ping the firewall's public interface using the Starlink ISP, then verify on the FortiGate whether you are getting traffic from the client workstation.

BR,

Rakesh

[mgoswami]

Hi,

Since you are able to connect to the Fortigate using your Mobile 4G connection, I suspect the issue to be with your Starlink. To siolate the issue, you could try to ping the firewalls interface with your Starlink ISP and see if packets are reaching the Fortigate. You could use the command:

diag sniffer packet any 'host <your Starlink Public IP and icmp" 4 0 a
and initiate the ping from your PC connected to Starlink ISP. If you don't see packets at all on the Fortigate, it will be an issue with the ISP.

Regards,

Manosh

[Diegov2421]

Hi.

Did you can resolve the problem about the vpn with starlink?

thanks

regards

[Vincent_THOMAS]

Hello, I'm stumbling into quite the same issue

One of my colleage lives in a remote house and now as deployed a Starlink

I've got a rule (geography)  that allows only connections from our country since our company is local

She can't log to the remote computers but if I enable all countries in the rule it's a pass

How do you from which country arrives the redirected starlink ?

[funkylicious]

Hi,

From the GUI you can view from IPsec Monitor the IPsec clients and the Remote Gateway column and there you can find the remote IP of the user.

After you have the remote IP you can check with the following command,

diagnose geoip ip2country IP , and see the country that the FortiGate sees it as

[abelio]

Hello denji0

we watched some similar issues a few weeks ago; solved by enabling NAT traversal

This article could be helpful:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPSec-VPN-nattraversal/ta-p/197873