- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Remote Subnet VPN Site to Site
Hello,
I have VPN site to site to connecting on-prem to the azure. The connection was working properly, local subnet in the on-prem can communicate to the remote subnet on azure.
But if i execute ping from FortiGate management ip why is not reachable? So if i change my LDAP connection from Server located in the on-prem to Azure VM, the connection is not success.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @HS08 ,
You can try to configure an IP address in tunnel interface then specify a source-ip. Check the KB below.
Pau
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI I'm not found where i should specify source-ip on my VPN site to site tunnel. Are you know where?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @HS08 ,
You need to configure tunnel IP address under Network > Interface > then locate the IPsec tunnel interface. After that, follow the guide given previously and see if it will work.
Pau
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI..
I'm not talking about SSL VPN but Site to Site VPN. What we see in interface is interface for SSL VPN.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @HS08 ,
You should be able to see the IPsec tunnel interface once you dig deeper under the WAN interface or whatever interface you have configured for IPsec VPN. This is different to the 'ssl.root' interface which is used for SSL-VPN.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IP-address-on-an-IPSec-tunnel-in...
Regards,
Pau
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Under LDAP can you specify the source IP as your on-prem interface IP and check?
# config user ldap
edit <LDAP object name>
set source-ip <IP address associated an interface>
end
make sure you are able to ping LDAP server on Azure is pingable using the source Ip (on-prem interface IP )
Suraj
- Have you found a solution? Then give your helper a "Kudos" and mark the solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @HS08,
It depends whether your management IP is included in the phase2 selectors or not and whether it is allowed in the firewall policy or not. For LDAP over IPsec tunnel, please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-with-remote-LDAP-via-site-t...
Regards,
