Site-to-site IPsec VPN with two FortiGates

[TJNIHAL]

Hi,

I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device.   I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing. Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.

[JackieTF · Accepted solution]

Hi TJ,

I can think of few things that you might want to check: 1. Traffic not passing from which site to which site? 2. Is there subnet conflict on both end? (mean both site have same local network) 3. check routing: get router info routing-table details x.x.x.x , replace the x.x.x.x with destination address 4. check policy, make sure policy is created for both direction with NAT disabled. 5. Finally, check debug flow and packet sniffer.

Regards, Jackie

[sangomab · Accepted solution]

Hi there, try this,     [size="3"]

diagnose debug disable
diagnose debug reset
diagnose vpn ike gateway clear
diagnose vpn ike log filter name YOUR_VPN_NAME
diagnose debug application ike -1
diagnose debug enable
 [/size]   and send back the logs   di de di to disable diagnose

[emnoc · Accepted solution]

He need's  NAT-T enabled. He should also dump the  show vpn phase1-interface and phase2-interface  details

e.g

show vpn ipsec phase1-interface

show vpn ipsec phase2-interface

[Ricardo_Tomas]

By the logs, seems Phase1 is up, but the log doesn't show negotiation.

stop the ipsec vpn, start the debug and start the vpn.

Somewhere in the log you will have to see the phase2 negotiation, if everything it's ok you will see phase2 exchanging the participating networks as dst and src, if the networks are wrong or you see something like 'no proposal chosen' or some type of miss match in phase2, edit it and compare the full Phase2 Selectors and then Phase 2 Proposal, like Encryption, PFS, Diffie-Hellman, Key Lifetime.

[emnoc · Accepted solution]

NAT-T should not bring the VPN fwiw.  You need to collect  some diag outputs . The below might come in handy. Just ignore the SRX stuf

http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html