Redirect Fortigate traffic into tunnel

[EricS]

Hello,

Two Fortigate are linked by an IPSec Tunnel. LAN traffic passes well through the tunnel, but the fortigate cannot communicate with a syslog server located on the other site. How to specify to sent this local traffic into the tunnel ?

[AEK · Accepted solution]

Hi Eric

Check phase 2 selector if it includes the FG sending IP address as well as syslog server address.

After that check with diag sniffer command on both FG nodes if the syslog traffic is correctly flowing through the tunnel.

[AEK · Accepted solution]

Hi Eric

Check phase 2 selector if it includes the FG sending IP address as well as syslog server address.

After that check with diag sniffer command on both FG nodes if the syslog traffic is correctly flowing through the tunnel.

[EricS]

Thanks for your fast answer. The phase 2 contains the site LAN Subnet and the SSLVPN subnet.

I launched the sniffer, the traffic is sent from the public IP.

9.270438 8x.xxx.xxx.x3.24957 -> 192.168.xxx.20.514: udp 941
9.270502 8x.xxx.xxx.x3.24957 -> 192.168.xxx.20.514: udp 1317
9.270545 8x.xxx.xxx.x3.24957 -> 192.168.xxx.20.514: udp 1028
9.270581 8x.xxx.xxx.x3.24957 -> 192.168.xxx.20.514: udp 941
9.270626 8x.xxx.xxx.x3.24957 -> 192.168.xxx.20.514: udp 1272
9.270662 8x.xxx.xxx.x3.24957 -> 192.168.xxx.20.514: udp 941
9.270700 8x.xxx.xxx.x3.24957 -> 192.168.xxx.20.514: udp 1134

Can I add ine the new selector the public IP as Local address and the xxx.20 IP as remote ?

[hbac · Accepted solution]

Hi @EricS,

To connect to a syslog server over IPsec tunnel, you need to specify the source-ip. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Syslog-server-over-IPSEC-VPN-and-sending-V...

Regards, 

[AEK]

Instead of adding public IP, specify the private source IP as shared by @hbac 

[EricS]

Thanks @hbac and @AEK  for your help, it works fine :)