Not change Action - Accept to IPsec

[RPasha]

Hi, I'm creacte new Vpn for hide traffic behind firewall's external interface. I can not change to "set action ipsec" edit 16 set srcintf "inet-core1" set dstintf "Life-pfase1" set srcaddr "net192.168.47" set dstaddr "Life site1" >>> set action accept set schedule "always" set service "ANY" set nat enable Firmware Version v4.0,build0632,120705 (MR3 Patch 8)

Example:

http://kb.fortinet.com/kb....do?externalID=FD33885

[Somashekara_Hanumant]

Hi Pasha,

Before configuring the Firewall policy, make sure you have configured the IPSec VPN tunnel in tunnel mode.

On the same KB article you can find how to create VPN tunnel using tunnel mode

Regards,

Somu

[TuncayBAS]

You opened VPN the interface mode.

[Christopher_McMullan]

Practically speaking, setting the policy action to Accept should be enough.

Make sure for an interface-based VPN to also create destination routes for the remote subnet, or else configure dynamic routing so that the VPN peers are aware of each others' interesting traffic. In this scenario, the Phase 2 Quick Mode selectors are exchanged during the tunnel negotiation, and will filter non-interesting traffic out, but the routing process on the FortiGate requires a route bound to the tunnel virtual interface named for your Phase 1 object.

[rwpatterson]

Yes, the "Action IPSec" is for the older policy based tunnel configuration. If you configured your IPSec tunnel in interface mode, then there will be no option to use IPSec because it is not available to be used for an interface. Interfaces simply use "Accept" for the traffic option.

(spelling correction)

[RPasha]

Thank, created new tunnel from CLI (Tunnel Mode) network net192.168.47 not to NAT AA.AA.AA.AA end tunnel down: # phase1 "Life-ph1": edit Life-ph1 set interface "inet" set nattraversal enable set dhgrp 2 set proposal 3des-sha1 set keylife 86400 set remote-gw xx.xx.xx.xx set psksecret zzzzzzzzzzz next end config vpn ipsec phase2 # phase2 "Life-ph2": set phase1name "Life-ph1" set proposal 3des-sha1 set src-addr-type name set use-natip disable set dhgrp 2 set dst-name "hostYY.YY.YY.YY" set keylifeseconds 3600 set src-name "All" next end # firewall policy: config firewall policy edit 3 set srcintf inet-core1 set dstintf inet set srcaddr net192.168.47 set dstaddr hostYY.YY.YY.YY set action ipsec set schedule always set service ANY set inbound enable set outbound enable set natoutbound enable set natip AA.AA.AA.AA 255.255.255.255 set vpntunnel Life-ph1 set status enable next

[RPasha]

Error in Phase 2: mismatch network 192.168.47.0/24 no nat to -> AA.AA.AA.AA 255.255.255.255

My Shema: Lan 192.168.47.0/24 -> tunnel (set natoutbound enable) from IP Internet address AA.AA.AA.AA -> xx.xx.xx.xx -> Cisco ASA -> hostYY.YY.YY.YY (Internet ip address)

[Christopher_McMullan]

Judging by the Quick Mode selector in Phase 2, the tunnel may be down because of a selector mismatch.

On the FortiGate side, you have "all to one", essentially. The other side would need to have "one to all" to match.

You're still creating a policy-based or tunnel-mode VPN from the looks of it.

Does the other side specify QM selectors with a destination of 192.168.47.0/24?

One other point to keep in mind: you can use address objects as the source and destination for your QM selectors, but you can't mix and match subnets and objects. You set the destination to an address, but the source to 'All'.

[Christopher_McMullan]

I'm not quite sure I understand your last post.