Site 2 Site VPN between two FortiGates. Both are behind a router

[AdminAnoa]

Hello together,

I have a question and didnt find any solution on the web.

We have two offices. A HQ (Augsburg) and a Branch (Berlin). Both have the same FortiGate 60F.

And both FortiGates are behind a Router. I configured both FortiGates to have a Transit-Network between the Router+Modem and the FortiGate. So both Fortigates can browse the web freely.

Now I want to connect both Firewalls via a IPsec Site to Site VPN.

The Problem is that both Firewalls are behind a NAT (because of the Router/Modem) if I understand that correctly. 

But I just cant seem to get the Tunnel working because you can only choose between NAT on the other side, or NAT on this site (In the IPsec Wizard)

Do I need a Connection Broker that is between both sides in the cloud? (Like Azure or something else)

And I should mention that both firewalls have different firmwares, but both are version 6.X.

Also, both Router/Modem have the Firewalls set to EXPOSED HOST.

And I have a working SSL VPN on HQ (Augsburg) for Remote Workers.

Can you please help me?

Best regards,

AdminAnoa

[akristof]

Hello,

Thank you for your question.

You can make it happen but you will need to make some kind of port forwarding on the router. So when the router will receive UDP 500/4500, it will forward it to the FortiGate. If you do it on site only, it should be enough. Then you can configure VPN like this:
FGT1 < static VPN > internet < NAT router > PortForward  < FGT2 with dynamic tunnel.

Of course, if the NAT router is changing public IP, you can DDNS on FGT2 to dynamically update DNS and then instead IP you can use fqdn on FGT1 to connect.

[AdminAnoa]

Hello,

thank you for the quick response! Both routers have a static IP. And I marked every Router as an Exposed Host, so every Port should be automatically forwarded or not?

[Debbie_FTNT]

Hey AdminAnoa,

yes, the exposed host setting should allow the router to forward traffic to the FortiGates. If there are port-specific settings, ensure that UDP 500 and 4500 are forwarded.

On each FortiGate, you need to configure the other side's router IP as gateway.

The firmware being different should not pose any issue, just make sure that the phase1 and phase2 parameters match up (same DH groups, same encryption algorithm etc).

In the wizard, select 'this side is behind NAT' or 'the remote side is behind NAT', that shouldn't make much of a difference.

If the VPN is still not working despite the settings in place, you can share some configuration snippets here for us to check, or you can get in touch with Technical Support to get an engineer to take a closer look and figure out where the breakdown is happening.