Newbie trying basic stuff

[KWigle]

I am a relative newbie to Fortinet that has a small amount of Fortinet experience but now I need to learn more.  I am fairly conversant with Cisco stuff.

Object - to eventually have two tunnels using certificates going to different networks.

Plan:

1. To set up a direct connection without anything, just wire to wire

2. Demonstrate one ipsec tunnel using passwords/passphrase

3. Demonstrate two tunnels using passwords/passphrase Tear down the above

4. Demonstrate one tunnel using a certificate

5. Demonstrate second tunnel using passwords/passphrase

Tear down password tunnel above

6.Demonstrate a 2nd tunnel using a certificate

Endstate possibilities: 2 tunnels using one each certificate/password

and 2 tunnels using only certificates

So what I'm playing with: laptop(192) -> Fortinet(.1) -> Fortinet(.2) -> laptop(172)

Direct connection: laptop -> Fortinet -> Fortinet -> laptop

from either laptop I can ping the local and remote Fortinet but not the remote laptop

Probably a firewall rule but I'm not getting this basic thing to work.

Any hints would be appreciated....

Kevin

[ede_pfau · Accepted solution]

hi,

and welcome to the forums.

What have you done so far? Can you post the policies (preferably from the CLI/console window)?

For a basic connection from one LAN to another you need:

- a route which tells the (leftmost) FGT where to send the traffic for the remote network

- a policy allowing such traffic

In your case you need this on both sides.

Of course, the subnets which you want to connect should not use the same address range.

For further analysis we need the output of

- get router info routing-table all

- get firewall policy

and info on the subnets involved.

[ede_pfau]

OK, subnet definitions and static route are OK, traffic is flowing.

Do you need pointers setting up the s2s VPN?

The VPN wizard is new to v5.2. Which version of FortiOS are you using?

[KWigle]

looks like v5.0, build 0208 (GA Patch 3)

These are 2 80 cm, new out of the box but they were purchased over a year ago ........

[ede_pfau · Accepted solution]

One good advice: upgrade firmware to the latest v5.0, which is 5.0.12 before continuing. You really don't want to suffer from the early firmware bugs.

With that little configuration you can upload the target firmware version in one step. Worstcase you'd lose the config, retyping will be much quicker than going all the immediate upgrade steps that usually are mandatory (see Release Notes).

[Allwyn_Mascarenhas]

ede_pfau wrote:

One good advice: upgrade firmware to the latest v5.0, which is 5.0.12 before continuing. You really don't want to suffer from the early firmware bugs.

With that little configuration you can upload the target firmware version in one step. Worstcase you'd lose the config, retyping will be much quicker than going all the immediate upgrade steps that usually are mandatory (see Release Notes).

a small doubt i have. Flash formatting the device and jumping straight to the latest FW on a new device is perfectly alright right? Or could there be any issues?