Policy problems / understanding using IPSec Lan-to-Lan VPN

[santgrac]

Hello, I have to build up a VPN Lan-to-Lan using IPSec from a Fortigaterouter 60B to another network.

I made Phase 1 and Phase 2 and I think the settings are correct because the other side can see the tunnel when I bring it up. But I can't send anything over the tunnel. The problem are the correct settings for the Firewall policies i guess. My network is like follow: My PC has IP adress 192.168.140.13 with gateway 192.168.140.252. In Phase 2 the Source adress is 192.168.17.0/25 and the Destination adress ist 192.168.17.128/25. In Phase 1 I specified the public IP adress from the other network (i'll call it network B) Now what I know from Networks in theory I have to make two routes:  - from my Gateway (192.168.140.252) to 192.168.17.128/25  - from public IP network B to 192.168.17.128/25 One network adress translation:  192.168.140.x/24 to 192.168.17.0/25 Am I right? But there are so many options I can choose that I don't know how to set it up, because when I try to make some traceroutes on my computer or on the CLI Console I never can reach adresses from 192.168.17.128/25 which I know they are online. Which Policy needs to be Action IPSec with VPN tunnel? I tried to make a policy like in the documentation from fortigate: 192.168.17.0/25 -> 192.168.17.128/25 Action IPSec

But there is something missing.. Hope someone can help me Thank you very much

Source address

[gschmitt]

santgrac wrote:

My PC has IP adress 192.168.140.13 with gateway 192.168.140.252. In Phase 2 the Source adress is 192.168.17.0/25 and the Destination adress ist 192.168.17.128/25.

Well there is your first problem.

Your Source Address for P2 is your internal network, your destination address is their internal network

[santgrac]

Hello gschmitt, thank you for your anwser. But it is correct to set in the Quick Mode Selector under Phase 2 the two internal networks or? I am reffering to:

http://docs.fortinet.com/uploaded/files/1086/fortigate-ipsec-vpn-50.pdf Gateway to Gateway configuration or http://docs.fortinet.com/...te-and-a-Cisco-ASA.pdf

[cbesse]

Hello, If the subnetwork 192.168.17.0/25 does not exist phyiscally, it's only use for the VPN connection ?

So, you juste need to modify your policy :

- Source address : Your internal Network 192.168.140.0/24 - Destination Address : 192.168.17.128/25 - enable nat  and use an IP Pool in the subnet 192.168.17.0/25

[santgrac]

Thank you for your reply. Yes, the 192.168.17.0/25 only exists for the VPN tunnel. I create the IP Pool for the device VPN tunnel (is that correct?) and changed the policy i had to: Source Interface/Zone: internal

Source Address: 192.168.140.0/24

Destination Interface/Zone: vpn tunnel Destination Address: 192.168.17.128/25 NAT activated and dynamic ip pool. But the trace is the same. Traza a 192.168.17.193 sobre caminos de 30 saltos como máximo.   1    <1 ms    <1 ms    <1 ms  192.168.140.252   2     *        *        *     Tiempo de espera agotado para esta solicitud. I add a picture of the network.

[rwpatterson]

Make sure the distance in the static route is lower than the distance for your default gateway. It shows 10 in your picture. Unless you changed the default, they're both 10. The static needs to be a route of less distance then the last resort (default) route.

[ede_pfau]

@rwpatterson: Bob, are you certain about this? I know it's one of your Strong Beliefs in FortiOS but...if Fortinet adheres to the RFC then the routing decision is made such that the most precise route is prefered. Like, to route a packet to 10.11.12.14 and two routes 10.11.0.0/16 and 10.11.12.0/24 present, with identical distance (and priority, a non-RFC FortiOS extension), the latter would be chosen because more bits match. (Yes, I've tested this and have this running for a couple of years here.)

As the least precise route of all routes conceivable is 0.0.0.0/0 any otherwise matching route with the same distance would be prefered. The default route is the "route of last resort" for a reason...

[santgrac]

Hello, I had now a bit more time. I followed the instructions in:

http://docs.fortinet.com/uploaded/files/1086/fortigate-ipsec-vpn-50.pdf  Page 63

Gateway - to - Gateway configuration, because the example is like mine. I did the same, tunnel is up but no luck. The tunnel is up, but I think because my computer is in a different subnetwork i have to add something more, like a additional route? And don't know if it is important, but the subnetwork 192.168.17.0/25 does not exist phyiscally. I attached the steps of the vpn, the policies and the static route.

Thank you!