Impossibility to reach device through VPN

[Alxndr3]

Hello.

Please,

I've set up a vpn between a Fortigate 90D v5.4.8,build1183 (GA) LAN 192.168.130.1 and a Fortigate 100D v5.6.4 build1575 (GA) 10.241.10.1, I can ping lans in both sides, but pinging on the device itself, for example from 90D to 100D it does not work, it works if I set it to ping from source 192.168.130.1, because of that I can't configure Fortianalizer.

I have other Fortigates configured the same way and that doesn't occurres.

Thank you.

[tanr]

So your (IPsec?) VPN is working between the lans, but logging from the remote FortiGate to a FortiAnalyzer across the VPN isn't working?

The FortiAnalyzer should be expecting the FortiGates internal IP (not the public IP used for the VPN). This is assuming you're connecting to the lan IP of the FAZ through the VPN.

  config log fortianalyzer setting     set source-ip <FortiGate Internal IP>   You'll need to have your routes and security policies defined to allow this.  The security policies, since they are going lan to lan through the VPN, should not use NAT.

[emnoc]

You could maybe set  a ip address in the vpn tunnel and  src-ip from that interface.

Ken Felix

[Alxndr3]

Thank's for the response.

Yes, logging from the remote FortiGate to FortiAnalyzer across the VPN isn't working.

From FortiAnalyzer I reach the local FortiGate's local interface.

FortiAnalyzer-400C # execute ping 192.168.130.1 PING 192.168.130.1 (192.168.130.1): 56 data bytes 64 bytes from 192.168.130.1: seq=0 ttl=254 time=28.338 ms 64 bytes from 192.168.130.1: seq=1 ttl=254 time=97.904 ms 64 bytes from 192.168.130.1: seq=2 ttl=254 time=105.249 ms 64 bytes from 192.168.130.1: seq=3 ttl=254 time=28.374 ms

--- 192.168.130.1 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 28.338/64.966/105.249 ms

FortiAnalyzer-400C #

Now, from FortiGate (192.168.130.1) I can't reach FortiAnalyzer (10.241.10.3)

FGT-DP4RS # execute ping 10.241.10.3

PING 10.241.10.3 (10.241.10.3): 56 data bytes

--- 10.241.10.3 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss

Unless

FGT-DP4RS # execute ping-options source 192.168.130.1

FGT-DP4RS # execute ping 10.241.10.3 PING 10.241.10.3 (10.241.10.3): 56 data bytes 64 bytes from 10.241.10.3: icmp_seq=0 ttl=62 time=27.7 ms 64 bytes from 10.241.10.3: icmp_seq=1 ttl=62 time=30.0 ms 64 bytes from 10.241.10.3: icmp_seq=2 ttl=62 time=28.6 ms 64 bytes from 10.241.10.3: icmp_seq=3 ttl=62 time=28.0 ms 64 bytes from 10.241.10.3: icmp_seq=4 ttl=62 time=28.9 ms

--- 10.241.10.3 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 27.7/28.6/30.0 ms

[tanr]

With my own setup doing logging from a remote FortiGate over IPsec VPN to a FortiAnalyzer I also set the local-ip for the vpn interface.  

One related question:  Are you trying to do this just for logging to the FAZ, or as part of a Fortinet Security Fabric?  With the security fabric there are a couple other hoops you need to jump through.

And note that you'll need appropriate security policies for all this.

[Alxndr3]

Hi, I'm sorry about the delayed response, but the issue remains;

I'm trying to connect FGW straight to FAZ.

It seems like this, but I can't set FGW to send packages using local interface 192.168.130.1 by default, I guess it would solve the question. 

[Alxndr3]

It worked now guys? Thank you very much! ######################

FGT-DP4RS # config log fortianalyzer setting

FGT-DP4RS (setting) # set server 10.241.10.3

FGT-DP4RS (setting) # set s

FGT-DP4RS (setting) # end

##############################

FGT-DP4RS (setting) # show full-configuration  config log fortianalyzer setting set status enable set ips-archive enable set server "10.241.10.3" set enc-algorithm high set conn-timeout 10 set monitor-keepalive-period 5 set monitor-failure-retry-period 5 set source-ip "192.168.130.1" set upload-option store-and-upload set upload-interval daily set upload-time 00:59 end

##############################

FGT-DP4RS (setting) # end

FGT-DP4RS # execute log fortianalyzer test-connectivity FortiAnalyzer Host Name: FortiAnalyzer-400C FortiGate Device ID: FGT90D3Z14002035 Registration: registered Connection: allow Disk Space (Used/Allocated): 0/1000 MB Total Free Space: 1847181 MB Log: Tx & Rx (log not received) IPS Packet Log: Tx & Rx Content Archive: Tx & Rx Quarantine: Tx & Rx

###############################