Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
KWigle
New Contributor III

Newbie trying basic stuff

I am a relative newbie to Fortinet that has a small amount of Fortinet experience but now I need to learn more.  I am fairly conversant with Cisco stuff.

Object - to eventually have two tunnels using certificates going to different networks.

Plan:

1. To set up a direct connection without anything, just wire to wire

2. Demonstrate one ipsec tunnel using passwords/passphrase

3. Demonstrate two tunnels using passwords/passphrase Tear down the above

4. Demonstrate one tunnel using a certificate

5. Demonstrate second tunnel using passwords/passphrase

Tear down password tunnel above

6.Demonstrate a 2nd tunnel using a certificate

 

Endstate possibilities: 2 tunnels using one each certificate/password

and 2 tunnels using only certificates

 

So what I'm playing with: laptop(192) -> Fortinet(.1) -> Fortinet(.2) -> laptop(172)

 

Direct connection: laptop -> Fortinet -> Fortinet -> laptop

from either laptop I can ping the local and remote Fortinet but not the remote laptop

 

Probably a firewall rule but I'm not getting this basic thing to work.

 

Any hints would be appreciated....

 

Kevin

2 Solutions
ede_pfau
SuperUser
SuperUser

hi,

 

and welcome to the forums.

 

What have you done so far? Can you post the policies (preferably from the CLI/console window)?

 

For a basic connection from one LAN to another you need:

- a route which tells the (leftmost) FGT where to send the traffic for the remote network

- a policy allowing such traffic

 

In your case you need this on both sides.

Of course, the subnets which you want to connect should not use the same address range.

 

For further analysis we need the output of

- get router info routing-table all

- get firewall policy

 

and info on the subnets involved.

Ede Kernel panic: Aiee, killing interrupt handler!

View solution in original post

Ede Kernel panic: Aiee, killing interrupt handler!
ede_pfau
SuperUser
SuperUser

One good advice: upgrade firmware to the latest v5.0, which is 5.0.12 before continuing. You really don't want to suffer from the early firmware bugs.

With that little configuration you can upload the target firmware version in one step. Worstcase you'd lose the config, retyping will be much quicker than going all the immediate upgrade steps that usually are mandatory (see Release Notes).

Ede Kernel panic: Aiee, killing interrupt handler!

View solution in original post

Ede Kernel panic: Aiee, killing interrupt handler!
13 REPLIES 13
ede_pfau
SuperUser
SuperUser

hi,

 

and welcome to the forums.

 

What have you done so far? Can you post the policies (preferably from the CLI/console window)?

 

For a basic connection from one LAN to another you need:

- a route which tells the (leftmost) FGT where to send the traffic for the remote network

- a policy allowing such traffic

 

In your case you need this on both sides.

Of course, the subnets which you want to connect should not use the same address range.

 

For further analysis we need the output of

- get router info routing-table all

- get firewall policy

 

and info on the subnets involved.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
KWigle
New Contributor III

So I can now ping between the laptops.

 

Now for the first ipsec tunnel.

 

Kevin

Dr_Pepper
New Contributor II

KWigle wrote:

So I can now ping between the laptops. [...]

 

How did you solve the problem?

It sounds like I'm facing the same issue right now..

KWigle
New Contributor III

at that point several months ago, I set up static routing on both Fortis.......

Then Firewall objects defined.

Then Policies defined to allow connection.

At that point I don't think I had any tunnel up yet.

rwpatterson
Valued Contributor III

If you built the tunnels in interface mode, then there really is no difference. The interface tunnel is used the same as Portx. Just make the policies and have a beer.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
ede_pfau
SuperUser
SuperUser

Please supply the info I've asked for if you want help, our crystal balls are foggy today.

For the VPN, use the Wizard. At first, use a very simple PSK and no fancy encryption algorithm: AES128 + SHA1 would be a standard.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
KWigle
New Contributor III

Please be a bit patient.  My corporate firewalls are murder.

I made my last entry before I even saw your first reply.

I will get the info and I appreciate your help.

KWigle
New Contributor III

here is some info..........

let me know if you need anything else.

 

# get router info routing-table all  

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area       

* - candidate default  

S*      0.0.0.0/0 [10/0] via 10.0.0.1, wan1

C       10.0.0.0/24 is directly connected, wan1

R       172.16.1.0/24 [120/2] via 10.0.0.1, wan1, 02:09:09

C       192.168.1.0/24 is directly connected, internal

***********

# get firewall policy   == [ 1 ]  

policyid: 1     == [ 2 ]  

policyid: 2    ***********

 

left network = 192.168.1.0/24 right network = 172.16.1.0/24 "Wan" = 10.0.0.0/24

 

ede_pfau
SuperUser
SuperUser

Alright, sorry, didn't mean to press you. We (the forums) are here all day and night.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors