IPsec behind NAT, with NAT-T failing, no ike debug info

[mbrowndcm]

Hello all, I am having a problem with one of my sites connecting into another site. Site A is the hub in the hub-spoke. Site B is a spoke (obviously). Site B has a primary and a secondary ISP. When Site B is routing over its primary ISP, there are no problems, and it connects into Site A. When Site B is routing over its secondary ISP, it can not connect. Site B is configured as follows: Fortigate -> Router/DSL modem/wifi AP/switch in-a-box -> internet The Fortigate is assigned a dynamic private address by DHCP, by the " modem box" (let' s say 192.168.1.10). The " modem box" has a public IP address assigned by DHCP from the ISP. The IPsec packets have a source address of the interface, 192.168.1.10. This is what is most interesting. How do I properly configure the Fortigate to handle this configuration? I figured use NAT-T. Would I need to do the following (that I' ve had to implement previously with double NAT): 1) within the VPN config, specify the Local Gateway IP to be the public IP [not possible in this config as the public IP is dynamically assigned] 2) add this IP as a secondary IP bound to the interface What is curious is there' s very little information returned with debug ike -1, or even the fgt2eth packet captures. I just see two ISAKMP packets (targeting the NAT-T port, TCP port 4500). Before I recommend that they spend more cash on getting a static address from their ISP, I' d like to see what others recommend in this situation. Again: 1) The source address in the IPsec header is the 192.168.1.10. 2) The source address of the packet when received is the public address of modem. = NAT traversal. Thanks, Matt

[TheJaeene]

Hi Matt, Just two ideas from my side: Have you tried to configure the Tunnel to SiteB as an dynamic/ddns Tunnel with Aggressive Mode on the HQ-FGT site, and on the SiteB-FGT as an StaticIP Aggressive Mode Tunnel with all the matching local IDs? Is the Providers Combo Box configured to forward IKE,NAT-T, ans ESP Packets to the SiteB-FGT? I once configured a double NAT Scenario with an dynamic Address on one Site with the setup below. HQ: edit " tu-to-site-B" set type ddns set interface " wan1" set keylife 7200 set peertype one set mode aggressive set proposal aes128-sha1 set remotegw-ddns " siteb.dyndns.org" set peerid " siteb.dyndns.org" set psksecret ENC topsecret next SiteB: edit " tu-to-hq" set interface " wan1" set keylife 7200 set mode aggressive set proposal aes128-sha1 set localid " siteb.dyndns.org" set remote-gw 1.2.3.4 set psksecret ENC topsecret set auto-negotiate disable next Regards, Jan

[mbrowndcm]

Thanks Jan for replying so quickly! You are describing having the SiteA' s fortigate be the initiator of the tunnel? I' m averse to using aggressive mode as it' s very easy to attack. I' m actually not quite sure that we' ve configure the Fortigate in the " DMZ" on the combo box (aka forwarded all IKE, NAT-T and ESP traffic)! UDP 500 <- IKE UDP 4500 <- NAT-T IP protocol 50 (if this is an option) <- ESP IP protocol 51 (if this is an option) <- Authentication header I' ll check this out first! Thanks, Matt

[TheJaeene]

Hi Matt, in this scenario I can initiate the Tunnel from both Peers. On the " ProviderBox" I forwarded IKE UDP500, NAT-T UDP4500 and IP Proto 50 to the Fortigate and disabled all features that sounded like VPN. Regards, Jan

[emnoc]

You don' t need to spend more money. Ideal on what I would look at; increase keepalive timers increase ike keepalive inspect NAT/XLATE exp timers inspect fwpolicy exp timers The latter 2 is on whatever device that does the NAT. FWIW I have device nailed to cisco with NAT-T and isa-sa are like 2/4weeks so I don' t think your problem is a fortigate specific issue.