L2TP/IPSec VPN on Fortigate which is behind a Velocloud Edge Device for SD-WAN

[envsion]

Working with a FortiGate that previously had a L2TP/IPSec VPN for Dial-up/Remote users configured. The device now sits behind a Velocloud Edge SD-WAN device and the WAN connection is plugged into it with an uplink from the edge device into WAN1 port on the Fortigate configured with a static LAN IP. Now from the Velocloud, they have setup a 1:1 NAT for the public IP that was once configured on the Fortigate for this traffic {PUBLIC IP --> FORTIGATE through the Velocloud device}, VPN connection fails in Phase 2 based on what I see within the logs. My thoughts, is that I need to add a Secondary IP to the WAN1 configuration on the Fortigate of the public IP address and configure that as the local gateway within the IPSec Tunnel network configuration. Just want to get some thoughts from the community on this.

[emnoc]

The cli cmd diag debug flow and no you should not need a secondary IP. I would ensure NAT-T  is enabled on the FGT

[envsion]

emnoc wrote:

The cli cmd diag debug flow and no you should not need a secondary IP. I would ensure NAT-T  is enabled on the FGT

I'll run that command now and post results, I do have NAT Traversal on the Tunnel set to Enabled.

[envsion]

I see a lot of these messages after running the diag debug flow command...

id=20085 trace_id=825 func=print_pkt_detail line=5253 msg="vd-root received a packet(proto=17, x.x.x.x:1004->10.x.x.x:500) from wan1. " id=20085 trace_id=825 func=resolve_ip_tuple_fast line=5328 msg="Find an existing session, id-0004972e, original direction"

Later on down, I see three messages with ID of 841 and a NAT-T Keep-Alive message.

id=20085 trace_id=841 func=print_pkt_detail line=5253 msg="vd-root received a packet(proto=17, x.x.x.x:51509->10.x.x.x:4500) from wan1. " id=20085 trace_id=841 func=resolve_ip_tuple_fast line=5328 msg="Find an existing session, id-000496d1, original direction" id=20085 trace_id=841 func=detect_unknown_spi4 line=1355 msg="NAT-T keep-alive"