- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue with Duo authentication through IPSec tunnel
We currently have our FortiGate connected over IPSec to Rackspace where we have our Duo server. For some reason I cannot get the FortiGate to see the Duo server's IP or recognize that it's there at all. When I try to test the connection, it says 'Server is unreachable'.
Any thoughts?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is the tunnel configured in policy mode (legacy) or interface mode?
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Bob, not sure if the PM I sent you a bit ago went through but hope all's well! Haven't touched a FortiGate since EHS like 8 years ago :)
The tunnel is in interface mode, the interface has all default settings from when the tunnel was created.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Replied to your PM.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just an update, Fortinet support and Rackspace are both pretty sure it's not them. Next step is Duo.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Update 2, CLI command not available in the GUI to edit the Duo server:
set source-ip XXX.XXX.XXX.XXX
The FortiGate was trying to access the server via the wrong IP, this fixed it.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Note: FortiGate tries to access remote server via IP inherited from egress interface, which is chosen according to set routing. Changing that might lead to RPF (reverse path check) issues. Better set correct routing to destinations.
If IPSec used , in interface mode, unnumbered, then most probably underlying physical interface IP was used. Then number the IPSec interfaces and route through them as through any other interfaces (next hop routing address), and that will magically solve the issue.
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
