Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Tannv
New Contributor

Site to site VPN

Hi,

 

I have configured vpn site to site between fortigate 60D(main office) and Cisco ASA 55xx(branch office), both sites can connect well.

I have tried to use Anyconnect to connect via Cisco ASA from home, After connected i can connect to all computer inside main office, but could not connect any computer at branch office.

I tried to ping from fortigate to Cisco ASA and vice versa but failed

 

Anyone can know the reason, how can i fix this?

 

Thanks a lot.

NVT
NVT
3 REPLIES 3
emnoc
Esteemed Contributor III

The cli diag debug flow is your friend on a FGT. The  Packet-tracer on the cisco ASA is your friend. Run both of these and review the diagnostic output. You need route and fwpolicies and don't rule out any SNAT configurations.

 

Both of these  tools is your 1st line tool for trouble-shooting

 

Ken

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
FortiKoala
Staff
Staff

Have a look at this cookbook http://cookbook.fortinet.com/ipsec-fortigate-cisco/ it describes the setups

 

You might also want to troubleshoot the packet flow through the FortiGate http://kb.fortinet.com/kb/viewContent.do?externalId=FD31702

 

Make sure your ip address is not being denied by the firewall policies

Deepakkhw
New Contributor III

Please check below details,

On Cisco ASA:

1. Cisco anyconnect subnet must be in nonat acl.

2. Anyconnect subnet must be on Crypto route map acl with destination subnet of your frotigate site. 

 

On Fortigate:

1. Anyconnect Subnet is allowed in Phase 2.

2. The policy is configured on FortiGate to allow traffic.

3. A route is configured for anyconnect subnet.

 

Regards,

Deepak Kumar

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors