Newbie trying basic stuff

[KWigle]

I am a relative newbie to Fortinet that has a small amount of Fortinet experience but now I need to learn more.  I am fairly conversant with Cisco stuff.

Object - to eventually have two tunnels using certificates going to different networks.

Plan:

1. To set up a direct connection without anything, just wire to wire

2. Demonstrate one ipsec tunnel using passwords/passphrase

3. Demonstrate two tunnels using passwords/passphrase Tear down the above

4. Demonstrate one tunnel using a certificate

5. Demonstrate second tunnel using passwords/passphrase

Tear down password tunnel above

6.Demonstrate a 2nd tunnel using a certificate

Endstate possibilities: 2 tunnels using one each certificate/password

and 2 tunnels using only certificates

So what I'm playing with: laptop(192) -> Fortinet(.1) -> Fortinet(.2) -> laptop(172)

Direct connection: laptop -> Fortinet -> Fortinet -> laptop

from either laptop I can ping the local and remote Fortinet but not the remote laptop

Probably a firewall rule but I'm not getting this basic thing to work.

Any hints would be appreciated....

Kevin

[ede_pfau · Accepted solution]

hi,

and welcome to the forums.

What have you done so far? Can you post the policies (preferably from the CLI/console window)?

For a basic connection from one LAN to another you need:

- a route which tells the (leftmost) FGT where to send the traffic for the remote network

- a policy allowing such traffic

In your case you need this on both sides.

Of course, the subnets which you want to connect should not use the same address range.

For further analysis we need the output of

- get router info routing-table all

- get firewall policy

and info on the subnets involved.

[ede_pfau · Accepted solution]

hi,

and welcome to the forums.

What have you done so far? Can you post the policies (preferably from the CLI/console window)?

For a basic connection from one LAN to another you need:

- a route which tells the (leftmost) FGT where to send the traffic for the remote network

- a policy allowing such traffic

In your case you need this on both sides.

Of course, the subnets which you want to connect should not use the same address range.

For further analysis we need the output of

- get router info routing-table all

- get firewall policy

and info on the subnets involved.

[KWigle]

So I can now ping between the laptops.

Now for the first ipsec tunnel.

Kevin

[Dr_Pepper]

KWigle wrote:

So I can now ping between the laptops. [...]

How did you solve the problem?

It sounds like I'm facing the same issue right now..

[KWigle]

at that point several months ago, I set up static routing on both Fortis.......

Then Firewall objects defined.

Then Policies defined to allow connection.

At that point I don't think I had any tunnel up yet.

[rwpatterson]

If you built the tunnels in interface mode, then there really is no difference. The interface tunnel is used the same as Portx. Just make the policies and have a beer.

[ede_pfau]

Please supply the info I've asked for if you want help, our crystal balls are foggy today.

For the VPN, use the Wizard. At first, use a very simple PSK and no fancy encryption algorithm: AES128 + SHA1 would be a standard.

[KWigle]

Please be a bit patient.  My corporate firewalls are murder.

I made my last entry before I even saw your first reply.

I will get the info and I appreciate your help.

[KWigle]

here is some info..........

let me know if you need anything else.

# get router info routing-table all  

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area       

* - candidate default  

S*      0.0.0.0/0 [10/0] via 10.0.0.1, wan1

C       10.0.0.0/24 is directly connected, wan1

R       172.16.1.0/24 [120/2] via 10.0.0.1, wan1, 02:09:09

C       192.168.1.0/24 is directly connected, internal

***********

# get firewall policy   == [ 1 ]  

policyid: 1     == [ 2 ]  

policyid: 2    ***********

left network = 192.168.1.0/24 right network = 172.16.1.0/24 "Wan" = 10.0.0.0/24

[ede_pfau]

Alright, sorry, didn't mean to press you. We (the forums) are here all day and night.