Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gsarica
Contributor

Issue with Duo authentication through IPSec tunnel

We currently have our FortiGate connected over IPSec to Rackspace where we have our Duo server. For some reason I cannot get the FortiGate to see the Duo server's IP or recognize that it's there at all. When I try to test the connection, it says 'Server is unreachable'.

 

Any thoughts?

6 REPLIES 6
rwpatterson
Valued Contributor III

Is the tunnel configured in policy mode (legacy) or interface mode?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
gsarica

Hi Bob, not sure if the PM I sent you a bit ago went through but hope all's well! Haven't touched a FortiGate since EHS like 8 years ago :)

 

The tunnel is in interface mode, the interface has all default settings from when the tunnel was created.

rwpatterson
Valued Contributor III

Replied to your PM.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
gsarica

Just an update, Fortinet support and Rackspace are both pretty sure it's not them. Next step is Duo.

gsarica

Update 2, CLI command not available in the GUI to edit the Duo server:

 

set source-ip XXX.XXX.XXX.XXX

 

The FortiGate was trying to access the server via the wrong IP, this fixed it.

xsilver_FTNT

Note: FortiGate tries to access remote server via IP inherited from egress interface, which is chosen according to set routing. Changing that might lead to RPF (reverse path check) issues. Better set correct routing to destinations.

If IPSec used , in interface mode, unnumbered, then most probably underlying physical interface IP was used. Then number the IPSec interfaces and route through them as through any other interfaces (next hop routing address), and that will magically solve the issue.

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Labels
Top Kudoed Authors