Ping CLI on web panel and SSH does not respond to FG VPN

[Cleyton_Agenil_da_Si]

Dear

I have the following scenario: I have two Fortigate connected via Ipsec VPN (FG 80E HQ + FG 50E BRANCH)

Behind the FG 80E HQ I have a Windows DNS server, resolving the DNS of the station behind the FG 50E. However, in the web management console of the FG 50E Branch in the DNS -> DNS Settings option, I specify DNS windows behind the FG 80E HQ. However DNS Servers is red, indicating that the Windows DNS server was not found. When pinging through the CLI console on the web panel or via SSH an error message appears, as shown in the image attached in this post. The LAN interface ip on the FG 80E HQ also does not respond to ping.

[brycemd]

The issue in both cases is source IP. The fortigate will use the interface IP it leaves from as it's source, in this case the IPSEC tunnel. The problem being that by default that IP is going to be 0.0.0.0 so it's effectively unroutable as a source IP. Unless you want to IP your IPSEC tunnel interfaces and make them routable you need to specify the source IP.

For DNS:

config sys dns

set source-ip x.x.x.x

end

For ping:

exec ping-options source x.x.x.x

exec ping x.x.x.x

There are source ip options like this for other services as well.. LDAP, RADIUS, etc. That are useful for IPSEC tunnels.

[Cleyton_Agenil_da_Si]

Thanks for the tip brycemd

I configured the Tunel interface, removing the default ip 0.0.0.0 and adding the source ip (Addressing mode Manual IP 10.1.2.1/32 and remote IP / Netmask 10.1.1.1/24 - Destination IP) I tried to route IP from the IPSENC VPN interface, but I'm not getting it.

[slashdes]

Hi! I have the same problem. How i can make routable IP and IPsec if ?

[brycemd]

The commands I put above are to get around the need for routable IPSEC interfaces. So that will work when they are set to the default 0.0.0.0.(the source IP you input being the LAN IP)

If you do want to make them routable it's a matter of assigning them a /32 IP on both ends and simply creating a route so it can get to each other. ie, on site A you assign 10.20.20.10/32 and on site B you assign 10.20.20.60/32. On site A create a route sending 10.20.20.60 across the tunnel, and on site B create a route sending 10.20.20.10 across the tunnel. You may need to add the 'routing subnet' to the phase 2 of the tunnel or simply change the phase 2 to 0.0.0.0/0.0.0.0

This will make it so when the traffic originating from the FortiGate itself going across the tunnel has a valid IP and the other side knows how to return the traffic.

[slashdes]

HI! Thank you for the answer.

My scheme is FG60->NAT FG61->internet->FG100

In my route table on FG60 i have three records which created after IPsec create.

One of that rows is 0.0.0.0/0.0.0.0 through Ipsec interface.

In phase2 Remote address parameter is 0.0.0.0/0.0.0.0.

I have successful ping from FG60 to remote networks behind FG100 with parameter SRC IP.

What i do wrong?