Ipsec & Double NAT - Fortigate 60D

[Mikelar]

Hi, I' m currently trying to setup a Fortigate 60D with an IPSec tunnel to one of our external providers. They' ve given me the specific VPN configs, and require us to NAT all traffic to their network to a specific address. I also need to NAT their network behind a local address, so that all of our internal hosts will connect to a single IP in order to connect to this providers server over the tunnel. So far I' ve got the tunnel up, and traffic going accross it, but I' m having a lot of trouble with the NATing. I' ve also found that under the IPSec monitor in the web config, I can see 2 tunnels at all times under the same name, although only one is able to be brought up. Diag debug of VPN traffic also confirms that there is constant phase1 attempts that go unanswered, despite the tunnel showing as up. Desired Setup: - External Provider will only ever see traffic from our network originating from the NAT address they' ve supplied us (150.x.x.229). - Internal Users will only ever see the providers server as the NAT address we' ve setup (10.136.21.10). Current Status: - IPSec tunnel: up - Ping external server: successful from firewall - Ping internal NAT from firewall: successful, but it' s not going over the tunnel. Looks like it' s only pinging it' s own interface with a repyl time of 0.2ms. - Ping internal NAT from host: unsuccessful Current Config: IPSec: - Phase 1 (non-interface mode) - Phase 2 - Quick Mode Selector - Source: 150.x.x.229 (provider NAT) - Dest: 150.x.x.10 (provider server) Policy: (1) srcport: internal dstport: wan1 srdaddr: 150.x.x.10, 150.x.x.229 dstaddr: 150.x.x.10, 150.x.x.229 action: ipsec sched/service: all nat: disabled (2) srcport: internal dstport: wan1 srcaddr: any dstaddr: VIP (10.136.21.10 -> 150.x.x.229) action: accept sched/service: all Static Routes: 0.0.0.0 wan1 172.16.0.1 150.x.x.10 wan1 172.16.0.1 10.136.30.0 internal 10.136.30.20 <various other internal static routes> I' ve attempted to setup the IPSec tunnel in Interface mode, but for some reason I can' t get the tunnel up. All other settings are identical, only the Local-gateway is set to the external VPN peer (62.x.x.x). Also note that the ADSL modem should not be an issue, as the tunnel has been established. Any suggestions or advice would be very much aprpeciated, I' ve dug through multiple resources to try and get this working. This is actually going to be a secondary link, as we already have an identical setup in another office to the same provider (only with a different model firewall). Cheers, Mike

[Sylvia]

Hi Mike, if I have to NAT a lot within an IPSec tunnel I would always prefer having the IPSec tunnel in interface mode. NATting with policy-based mode is really limited. I understand that you have already tried this and the tunnel didn' t get up with interface mode. (I guess that the QM selectors didn' t match or that no firewall policy where configured - but you can troubleshoot the issue with diag deb ena, diag deb appl ike -1) Anyhow - I would try to solve the problem with the interface mode and then try to do the NAT stuff. Regards, Sylvia

[emnoc]

Agreed and I never heard of anybody attempting this and in a policy-based vpn. IIRC in the policy-based vpn the proxy-ids are normally defined by the traffic matching that policy. I would build a ip pool ( 150.x.x.229 ) apply it to a fwpolicy for the SNAT . Change the vpn as mention before to interface-mode and route-based and then give it a try. Sylvia hit the nail squarely on the head with using the diagnostic commands to help steer along the path. I would also include the diag debug flow as part of your diagnostic

[ede_pfau]

Of course you would, Ken :-)) and right so! OP, for interface mode VPN, you need - phase1 and phase2 (in CLI: phase1-interface and phase2-interface) - a policy - a static route pointing the remote subnet to the tunnel interface (same name as the phase1)

[Mikelar]

Thanks all for the replies, very much appreciated. The more I read up on NAT and IPSec tunnels on the fortigate, the more I was leaning towards interface mode. I' ve used the diag debug commands quite a lot with my troubleshooting all last week, so I think it will be more of a matter of figuring out why the tunnel wont come up in interface mode. I recall the debug output giving me something along the lines of ' No matching Policy' , despite the settings being nearly identical to my setup in policy mode. I think with some more detailed troubleshooting the tunnel could be established in interface mode, and the NAT and routing should be easier to implement. Unfortunately the fortigate was only loaned to us to test this setup, as we' ve had issues with other firewalls not supporting the required NAT functionality when attempting to implement this link. I no longer have access to the fortigate, but if the unit does support the features we need, we' ll likely be purchasing the same unit in the near future. Is anyone able to confirm that what I' m attempting to do here is possible with the Fortigate 60D ? Again thanks for all you' re responses, these forums look like a great resource. Cheers, Mike