Using SNAT before L2L

[OrKarstoft]

Hello Fortinet Forum!

I've ran into an issue with NAT and usually it just works. I hope you can help me out.

I have two Fortigates (A and B) with site-to-site VPN between them.

Fortigate A needs to be NATed from 192.168.100.0/24 to 10.10.100.253. Therefore I've created a IP Pool as follows;

Type: Overload

External IP Range: 10.10.100.253 - 10.10.100.253

ARP reply: tick

Fortigate B have LAN 192.168.254.0/24

My policy is as follows;

Incoming Interface: Interface mastering 192.168.100.0/24

Outgoing Interface: site-to-site interface

Source: 192.168.100.0/24

Destination: 192.168.254.0/24

Service: ALL

Action: Accept

NAT: Enabled

IP Pool Configuration: Use Dynamic IP Pool (The overload mentioned above)

The site-to-site phase 2 have the following

Local Address: 10.10.100.0/24 (The NATed address)

Remote Address: 192.168.254.0/24

The site-to-site is state UP.

I run the following diagnose command to troubleshoot;

diagnose debug enable

diagnose debug flow filter addr 192.168.100.1

diagnose debug flow trace start 100

The outcome of those diagnose commands is;

id=20085 trace_id=246 func=print_pkt_detail line=5519 msg="vd-root:0 received a packet(proto=1, 192.168.100.1:14848->192.168.254.1:2048) from local. type=8, code=0, id=14848, seq=0." id=20085 trace_id=246 func=init_ip_session_common line=5684 msg="allocate a new session-01ce3079" id=20085 trace_id=246 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-L2L" id=20085 trace_id=246 func=ipsec_common_output4 line=804 msg="No matching IPsec selector, drop"

I know the "No matching IPsec selector, drop" means that it doesn't match in my IPsec phase 2 but it would if the NAT worked as I was told, it would match.

As far as I know the network packet should match the source and destination in the policy. Then be NATed before entering the IPsec tunnel but in the diagnose output it doesn't look like it's being NATed.

received a packet(proto=1, 192.168.100.1:14848->192.168.254.1:2048

Can someone give me a hint?

[emnoc]

Do you have a vpn estaghlisted

  diag vpn tunnel list

diagnose shows that is part of the issue or should be check. You can also tell when this is working of you do a

   diag sniffer packet <named rt interface for vpn>

If your ipsecSA is up and the nat is working, the src-ip would be 10.10.100.253

Ken Felix

[OrKarstoft]

Thanks your your reply emnoc!

Doing diag vpn tunnel list shows me the SA's and the one with src: 10.10.100.0/24, dst: 192.168.254.0/24 is there. The IPSec Monitor also shows all phase 2's UP.

Doing diag sniffer packet <tunnel interface> shows that I try to send and echo request, if I do it from the firewall with;

exe ping-options source 192.168.100.1

exe ping 192.168.254.1

If I ping from a client on the 192.168.100.0/24 subnet and pings towards the 192.168.254.0/24 nothing shows in the diag sniffer packet <tunnel interface> output regarding the ping.

If I use the policy lookup feature in the webinterface.

From: 192.168.100.0/24 interface

To: Tunnel interface

Source: 192.168.100.1

Destination: 192.168.254.1

It highlights the correct policy where I've put my IP Pool/NAT.

[alfred0809]

NAT interesting traffic with IPSEC L2L How do I NAT interesting traffic going through a L2L tunnel? The NAT'ing happens on the same router that it the L2L tunnel terminates on. Below is the config for the two routers. I have an ISP in between, but everything is routing and working correctly w/o the NAT. Once I enable the NAT, my tunnel breaks. All other traffic needs to PAT to an interface, I have a NAT exemption, for the LAN of the L2L, and built a separate SNAT for the VPN L2L traffic. https://vidmateapp.win jalsha moviesz

[emnoc]

Diag debug flow , did you use it? What's probably happening

1: client is not routing to the fw

or

2: or a higher preference fwpolicy is taking action before the policy that uses the vpn, so I bet your traffic is not going out the vpn tunnel but rather the wan

Ken Felix

[alfred0809]

I am aslo facing the same error so Kindly please help me to find  a solution

VidMate Momix Download Vidmate