Issue with Duo authentication through IPSec tunnel

[gsarica]

We currently have our FortiGate connected over IPSec to Rackspace where we have our Duo server. For some reason I cannot get the FortiGate to see the Duo server's IP or recognize that it's there at all. When I try to test the connection, it says 'Server is unreachable'.

Any thoughts?

[rwpatterson]

Is the tunnel configured in policy mode (legacy) or interface mode?

[gsarica]

Hi Bob, not sure if the PM I sent you a bit ago went through but hope all's well! Haven't touched a FortiGate since EHS like 8 years ago :)

The tunnel is in interface mode, the interface has all default settings from when the tunnel was created.

[rwpatterson]

Replied to your PM.

[gsarica]

Just an update, Fortinet support and Rackspace are both pretty sure it's not them. Next step is Duo.

[gsarica]

Update 2, CLI command not available in the GUI to edit the Duo server:

set source-ip XXX.XXX.XXX.XXX

The FortiGate was trying to access the server via the wrong IP, this fixed it.

[xsilver_FTNT]

Note: FortiGate tries to access remote server via IP inherited from egress interface, which is chosen according to set routing. Changing that might lead to RPF (reverse path check) issues. Better set correct routing to destinations.

If IPSec used , in interface mode, unnumbered, then most probably underlying physical interface IP was used. Then number the IPSec interfaces and route through them as through any other interfaces (next hop routing address), and that will magically solve the issue.