[SOLVED] IPsec VPN tunnel between Watchguard and Fortigate is UP/traffic one way

[ITadm]

Hello,

 I struggle with a site-to-site VPN tunnel between 2 locations. I use Watchguard Firebox XM200 and Fortigate 30E. It looks like this:

WatchGuard 192.168.0.1 (or 1.1) ----------> net ------------> Fortigate 30E 10.113.14.1

Traffic goes only from 192.168.0.1 to 10.113.14.1, the opposite site doesn't work at all, I cannot even ping anything. The better explanation below:

Here is the setup from FGT:

And here is Watchguard:

BOVPN Gateway Settings: T Tunnels: T IKE Version: IKEv1 Credential Method: Pre-shared Key Endpoints Endpoint 1 Local Interface: WAN-FC_ Local ID: 77. (IP Address) Remote IP Address: 91. Remote ID: 91. (Domain Name) (when set as IP address it gives ID error) Phase 1 Settings Mode: Main NAT Traversal: Disabled IKE Keep-alive: Disabled Dead Peer Detection: Enabled (20 second timeout, 5 max retries) Auto Start: Yes Transforms Transform: 1 Authentication: MD5 Encryption: DES SA Life: 24 hours Key Group: Diffie-Hellman Group 5 BOVPN Tunnel Settings: T BOVPN Gateway: T Tunnel Routes Route 1 Local: Any Remote: 10.113.14.0/24 Direction: bi-directional Allow Broadcast: No Route 2 Local: Any Remote: 10.10.6.0/26 Direction: bi-directional Allow Broadcast: No Route 3 Local: Any Remote: 10.10.6.128/28 Direction: bi-directional Allow Broadcast: No Phase 2 Settings Perfect Forward Secrecy: Enabled (Diffie-Hellman Group 14) IPSec Proposals Proposal 1 Name: ESP-DES-MD5 Type: ESP Authentication: MD5 Encryption: DES Key Expiration: 8 hours Multicast Settings Multicast over tunnel: Disabled Origination IP: Group IP: Send multicast traffic on: Receive multicast traffic on: Helper Addresses Local IP: Remote IP:   And of course Any policy on firewall both sides (allow.in & allow.out).   Here is how it works: there are no VPN tunnel errors, tunnels are up, I have full access from Watchguard to Fortigate, all ports and protocols, but from the other side I can't even ping 192.168.0.1 or 192.168.1.1. In Fortiview I can see that packets go to RA tunnel, but I cannot see anything coming at Watchguards Traffic Monitor.   I desperately need help!  

[Ashik_Sheik]

Hi 

Configuration looks fine , try to define remote subnet in Phase2 and check.

Regds,

Ashik

[ITadm]

Thanks for quick reply! I've just defined it as 192.168.0.0/24, tunnel is up, but still no traffic from one side:

Pinging 10.113.14.150 from 192.168.0.40 and opposite site:

In addition:

Destination interface is RA_DC interface tunnel, so this one looks fine, but there is no trace of these packets on WatchGuard traffic monitor (log on both in & out firewall policies is on).

[Ashik_Sheik]

Traffic not going could be issue with static route or policies ..Just make sure static route to each side and destination to tunnel is correct and as well as policies on both sides.

Regds,

Ashik

[ITadm]

There is no static route on Watchguard, but I have like 10 tunnels active and they work just fine without it. Policies on watchguard look like this:

VPN tunell -----> any

any -----> VPN tunell

Every port and protocol. I tried different things, but still no luck :(

Adding static route on WatchGuard looks like this:

So it's a static route for outgoing traffic, but this one already works. On Fortigate it looks like this:

Remote subnet address pool consist 192.168.0.0/16. Adding this route allowed traffic from WG to FGT

[Ashik_Sheik]

Hi I can help u ...if u give me remote of  FGT ..watchguard i have not idea ..

Share me your teamviewer ID .Another 30  min i am available .

Regds,

Ashik

[Prab]

Hi,

On the FGT CLI try the following commands & check if you get any reply:

[style="background-color: #ffffff;"]execute ping-options source 10.113.14.1[/style]

[style="background-color: #ffffff;"]execute ping 192.168.0.1[/style]

The above command will tell the FGT to use 10.113.14.1 as a source IP address to ping 192.168.0.1.

You could try to ping a different destination IP from 192.168.0.0/16 subnet too.

If your IPsec configuration + routing + policy configuration is correct then you should be able to get a reply, assuming that the remote device is allowed to respond the ICMP Echo packets.

Hope it helps!

Thanks,

Prab

[ITadm]

Hi,

 Thanks for the replies!

@ashik I'd love to give you that access, but it's a corporate network and I'd get fired the very next day :( But, thank you for your will to help, I really appreciate it!

@Prab

The results shocked me:

Thanks for the advice! It looks like the FGT settings are the problem since they block traffic from LAN hosts. Can you give me an idea what can be wrong? Both firewall policies look like this:

(vlan group) --> tunnel address 

tunnel address --> (vlan group)

[pictures in my first post]

EDIT:

Gentelman, I finally solved it. I just needed to turn off NAT in FGT firewall policy settings. Works like a charm!

Thank you very much for your help!

I can't believe it was THAT easy and I couldn't figure it out for a few days.

[Ashik_Sheik]

Grt , good to know .You haven't shared policy setting so couldn't able to identify the issue .

Also as prab mentioned by default u can't ping vpn other site host from FGT , only sourse ping with LAN interface is possible .

Regds,

Ashik

[ITadm]

One last strange thing, on policy .in on FGT NAT has to be ON while on policy .out it has to be OFF and then it works properly. When I turn off NAT on policy .in I can ping 50% of workstations in the same VLAN. I have to learn more to understand it :D

Thank you and Best Regards!