Site to Site Forti - Check Point

ede_pfau wrote:
What are the phase1 and phase2 parameters on the CP side?
From the very first screenshot it looks like the CP puts the WAN addresses into the ph2 QM selectors (whereas the FGT does it right). I would focus on this as it is the reason why the tunnel doesn't get established.

Hi,

First, Thank you about your replay.

This is the phase 1 +2 of CP

http://jpg.co.il/view/562d3ad9249a6.png/

[link]http://jpg.co.il/view/562d3aed02765.png/[/link]

http://jpg.co.il/view/562d39cad197e.png/

I hope that what you asking.

ede_pfau · ‎10-25-2015

I think I have finally found the reason for this.

First, have a look at this: http://kb.fortinet.com/kb/viewContent.do?externalId=12091

Although this was written for FortiOS v3 it still applies.

I think the CP will only accept the remote's WAN IP address in the Quick Mode selection, not the private address space behind the FGT. This way, there will never be an address conflict, as WAN addresses are unique, private addresses usually are not.

If you follow the KB article you should be able to have traffic from the FGT to the CP site. The other way will be more difficult as the CP only accepts one 'target' address. You should try it out if the destination NAT on the FGT side will suffice (using a VIP).

- CP does weird stuff

Ede Kernel panic: Aiee, killing interrupt handler!

amitbd · ‎10-26-2015

ede_pfau wrote:
I think I have finally found the reason for this.
First, have a look at this: http://kb.fortinet.com/kb/viewContent.do?externalId=12091
Although this was written for FortiOS v3 it still applies.
I think the CP will only accept the remote's WAN IP address in the Quick Mode selection, not the private address space behind the FGT. This way, there will never be an address conflict, as WAN addresses are unique, private addresses usually are not.
If you follow the KB article you should be able to have traffic from the FGT to the CP site. The other way will be more difficult as the CP only accepts one 'target' address. You should try it out if the destination NAT on the FGT side will suffice (using a VIP).
- CP does weird stuff

I dont have option Encryption 3DES. I have only Des.

All other settings I've set,exept Virtual Ip and it does not help

I upload the tracker message from forti - Amit ( Cp ).

http://jpg.co.il/view/562ddea807ef4.png/

http://jpg.co.il/view/562ddecf67b99.png/

http://jpg.co.il/view/562dded9917d8.png/

http://jpg.co.il/view/562ddee424a68.png/

[link]http://jpg.co.il/view/562ddef81e864.png/[/link]

amitbd · ‎10-26-2015

I can do SiteToSite with WAN 192.168.X.X or I must Original IP ?

ede_pfau · ‎10-26-2015

From the cited KB article I deduct that you have to use the WAN IP of the FGT in the CP's Quick Mode selector. If you use DES or 3DES doesn't matter much.

Please reread the KB article again to understand what they are doing. You'll see that the VIP (destination NAT) is essential and cannot be left out, or the setup will not work.

BTW, with all that effort, wouldn't it be less trouble and less expensive if you bought a FGT for the other side as well? Just thinking.

Ede Kernel panic: Aiee, killing interrupt handler!

amitbd · ‎10-27-2015

ede_pfau wrote:
From the cited KB article I deduct that you have to use the WAN IP of the FGT in the CP's Quick Mode selector. If you use DES or 3DES doesn't matter much.
Please reread the KB article again to understand what they are doing. You'll see that the VIP (destination NAT) is essential and cannot be left out, or the setup will not work.

BTW, with all that effort, wouldn't it be less trouble and less expensive if you bought a FGT for the other side as well? Just thinking.

I dont understand where is CP Quick Mode Selector.

In my Forti Object on CP have the wan IP of Forti

ede_pfau · ‎10-27-2015

Sorry, no idea. I have no first-hand experience with CP.

Ede Kernel panic: Aiee, killing interrupt handler!

amitbd · ‎10-27-2015

someone else ?

Site to Site Forti - Check Point

Nominate a Forum Post for Knowledge Article Creation