I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device. I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article. In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing. Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware. Thanks.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi TJ,
I can think of few things that you might want to check: 1. Traffic not passing from which site to which site? 2. Is there subnet conflict on both end? (mean both site have same local network) 3. check routing: get router info routing-table details x.x.x.x , replace the x.x.x.x with destination address 4. check policy, make sure policy is created for both direction with NAT disabled. 5. Finally, check debug flow and packet sniffer.
Regards, Jackie
Hi there, try this, [size="3"]
diagnose debug disable
diagnose debug reset
diagnose vpn ike gateway clear
diagnose vpn ike log filter name YOUR_VPN_NAME
diagnose debug application ike -1
diagnose debug enable
[/size]
and send back the logs
di de di to disable diagnose
sangomab is ...
He need's NAT-T enabled. He should also dump the show vpn phase1-interface and phase2-interface details
e.g
show vpn ipsec phase1-interface
show vpn ipsec phase2-interface
PCNSE
NSE
StrongSwan
NAT-T should not bring the VPN fwiw. You need to collect some diag outputs . The below might come in handy. Just ignore the SRX stuf
http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html
PCNSE
NSE
StrongSwan
By the logs, seems Phase1 is up, but the log doesn't show negotiation.
stop the ipsec vpn, start the debug and start the vpn.
Somewhere in the log you will have to see the phase2 negotiation, if everything it's ok you will see phase2 exchanging the participating networks as dst and src, if the networks are wrong or you see something like 'no proposal chosen' or some type of miss match in phase2, edit it and compare the full Phase2 Selectors and then Phase 2 Proposal, like Encryption, PFS, Diffie-Hellman, Key Lifetime.
NAT-T should not bring the VPN fwiw. You need to collect some diag outputs . The below might come in handy. Just ignore the SRX stuf
http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1645 | |
1070 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.