Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Treuz
New Contributor

IPsec VPN help

Hello all, i need to create an IPsec VPN with a Public Authority that needs to reach an FTP server in my local network (192.168.0.0/24). They are expecting to reach my machine through a subnet defined by them that is 10.50.41.208/30, my ftp server is supposed to answer at address .209. My local subnet is 192.168.0.0/24 while the FTP machine is .20. What's the way to properly setup IPsec VPN and NAT/Routing to let my FTP server in local subnet be reachable through the addresses imposed by the client? I have a Fortigate 90D with firmware v5.6.3 build1547 (GA).

Thanks in advance.

3 REPLIES 3
Toshi_Esumi
SuperUser
SuperUser

I think they would route the /30 into the tunnel on their end. You must have gotten another subnet on their end for you to route into the tunnel from your end. Then you can use VIP with .209 address for FTP protocols to map to your FTP server's local IP 192.168-something, and use it with the inbound policy for the VPN.

emnoc
Esteemed Contributor III

Also phase2 stc-subnets must be the  VIP  address and not the server.

 

 

e.g

 

 

config vpn ipsec phase2-interface

    edit MYVENDOR

           set src-subnet 10.50.41.209/32

   end

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Treuz
New Contributor

toshiesumi wrote:

I think they would route the /30 into the tunnel on their end. You must have gotten another subnet on their end for you to route into the tunnel from your end. Then you can use VIP with .209 address for FTP protocols to map to your FTP server's local IP 192.168-something, and use it with the inbound policy for the VPN.

Correct: they have provided another /29 subnet for me to route into the tunnel.

 

emnoc wrote:

Also phase2 stc-subnets must be the  VIP  address and not the server.

e.g

config vpn ipsec phase2-interface

    edit MYVENDOR

           set src-subnet 10.50.41.209/32

   end

 

I'm not very familiar with console so i'm using the web interface.

 

So if my understanding is correct i need to setup the VPN tunnel between the two subnet with the /30 (or the single /32 address?) as source and the other subnet as destination. Then i create a VIP entry from .209 to my FTP server on local 192.168.x.x and I add this entry into an allow policy in the tunnel interface.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors