L2TP Passthrough (RESOLVED)

[nabeards]

We are trying to enable L2TP passthrough to a Mac OS X Mavericks server. L2TP passthrough is fairly trivial on other routers, but our Fortigate 40C with FortiOS 5 is making it quite the challenge. I' ve setup port forwarding via Virtual IPs with the following: UDP 500 UDP 4500 UDP 1701 Then created a Policy entry as Incoming: wan1 Address: all Outgoing: internal Destination: the above VIPs Schedule: always Service: ESP, IKE, L2TP I' ve tried turning off/on NAT in that Policy, setting AutoIPSec to ' on' on the wan1 interface, having the router' s VPN on and off, adding other Ports (TCP 500, 4500, 1701, and 1293 both TCP and UDP). Still no luck. I' ve confirmed the VPN service is functioning properly on the OS X Server by connecting from an internal client just fine. I enabled logging on the Policy, and if VPN on the router is turned on I see the connections come from the external device on ports 500 and 4500 only. If VPN on the router is off, I get 0 packets on that Policy. Any help would be most appreciated! I' m familiar with routers, command line tools, etc., but not an expert on Fortigate.

[emnoc]

What if you remove port forwarding for a temporary test , make it a 1-2-1 VUIP, with services ALL and see if it works? if it works than you an conduct further test and diagnostics within your port-forward configurations. Back to your policy, you also must realize that the ESP traffic is not a port, so maybe port-forwarding is not going to help in that area. Did you run any diag debug flow on traffic for that policy ? Diag debug flow is your friend.

[nabeards]

Thanks Emnoc. For the first test, are you saying to make a Virtual IP with just the server address, then setup a Policy that all Services go to it? (I' m not familiar with 1-2-1 VUIP, sorry!) Understood on ESP port forwarding; I had added it as a service to forward within the Policy. I have not tried diag debug flow yet. I' d love to get it actually working using your step 1 first, then try restricting and run this to see what' s going wrong. Neil

[emnoc]

Yes and that was suppose to be a VIP. Map a 1-2-1 VIP between public and inside and allow all. If that works, than troubleshoot the port forwarding and your fwpolicies. ( basically a VIP with no port forwarding ) Also diag debug flow will shed some light as to what might be the issue(s).

[nabeards]

emnoc, I was able to get to the point where my internal Mac OS X VPN server is getting the IKE requests properly forwarded through the Fortigate. However, the VPN server cannot reply to the connecting VPN client (it constantly logs Phase 1 Retransmit messages until it times out). Using ' diag debug flow' , I was able to see that the IKE response is attempting to be sent to the wan1 IP address instead of the IP address of the actual client. So vpnServer:500->wanIPaddress:500 was in the debug console and I would expect vpnServer:500->vpnClient:500. I have disabled everything on the Firewall at this point, except for the two following rules: 1 internal wan1 all all always ALL Accept 2 wan1 internal all MMSall always ALL Accept and MMSall is a Virtual IP setup as: External Interface wan1 Type Static NAT <unchecked> Source Address Filter External IP Address/Range 0.0.0.0 - 0.0.0.0 Mapped IP Address/Range ipOfVPNServer - ipOfVPNServer <unchecked> Port Forwarding The only other settings I' ve played with are making the policy rule 2 act as a NAT, as a NAT with static port, and as a NAT with an IP pool equal to my VPN server IP pool (no difference between these); and enabling/disabling the ' Auto-IPSec' on both the wan and internal Interfaces. Any other suggestions to get to a solution? Neil

[nabeards]

One more bit of info: LAN IPs: 192.168.1.100 - 192.168.1.230 VPN IPs: 192.168.1.90 - 192.168.1.94 External LAN IPs: 10.0.1.100 - 10.0.1.200 as well as some others (not overlapping anything 192.168.*.*)

[rwpatterson]

Try making the VPN IPs a unique subnet from the LAN. You can' t route to the same network across a router or firewall... Also, I would change the LAN IP subnet to something other than the most popular default private network out there.

[nabeards]

I' ve not had a problem with this IP setup in the past with other routers. As long as the IPs for the LAN and the VPN don' t overlap, it should work correctly. Is this something specific to Fortigates? I agree on using a more unpopular subnet, but I' m working with a network I didn' t setup initially. I should be able to change this soon, but in the meantime I' m making sure my testing external LANs aren' t the same subnet. Thanks, Neil

[nabeards]

Well, looks like this was a Mavericks Server L2TP VPN bug! [link=]http://iphone.appleinsider.com/articles/13/12/19/apple_fixes_vpn_connection_issue_with_mavericks_server_update_.html[/link] I installed the update, and am now able to VPN in just fine. Now to fix the DNS issues, but direct IP connections are working great! Thanks for your help everyone. Neil