VPN Console

[hemantraturi]

Hi,

I am unable to create vpn via central vpn console. Policies are not getting deployed .Can someone post step by step instruction?

[scao_FTNT]

1, in VPN console add a new VPN like a full meshed VPN

2. in VPN, add gateway (FGT devices in this ADOM)

3. when you choose "Default VPN Interface" for gateways

  a. this interface, has interface mapping for that gateway, pls check in "Policy & Objects" tab and below "Object" - "Interface" page, so the name used, should have mapping for each device so we know when install which interface to use

  b. the mapped interface has IP configured, we do not support DHCP mode interface for now (IP dynamic received and not in config by using static IP, for dynamic IP case, need to use DDNS for the VPN support)

4. after VPN created, system will auto generate hidden VPN zone interface for policy, so in policy package, create policies with these interfaces (you can select from policy interface list)

if you can not install config,  what error you see in install policy package wizard?

Thanks

Simon

[hemantraturi]

thanks for the response.

I intend to create dial-up vpn where spokes are managed by FMG and hub is unmanaged. Therefore i have to configure vpn on spoke via fmg. Please explain in the below steps.

1, in VPN console add a new VPN dial up VPN--->Done 2. in VPN, add gateway (FGT devices in this ADOM)---> which gateway option to select(external or managed)

3. when you choose "Default VPN Interface" for gateways----> Since i have got all 30D appliance, so i have mapped wan interface to external and lan to internal

4. after VPN created, system will auto generate hidden VPN zone interface for policy, so in policy package, create policies with these interfaces---> 3 zones are created vpnmgr_spoke2hub, vpnmgr_hub2spoke and vpnmgr_mesh, how do i create policies for spokes, can you give example explaining which interfaces to select

Thanks

Hemant

[hemantraturi]

getting below error for internal to vpnmgr_spoke2hub policy

NamePercentageDescriptionFortiGate-VM64[copy] (root)1%2015-10-10 10:27:37:Start copying policy to devdb, device(FortiGate-VM64), vdomid(root)FortiGate-VM64[copy] (root)1%2015-10-10 10:27:37:Unsupported phase1 encryption for vpn testFortiGate-VM64[copy] (root)50%2015-10-10 10:27:37:vdom copy errorFortiGate-VM64[copy] (root)100%2015-10-10 10:27:37:Copy rollbacked, due to errorFortiGate-VM64[copy] (root)100%2015-10-10 10:27:37:Aborted due to previous errorFortiGate-VM64[copy] (root)100%2015-10-10 10:27:37:task finished

[hemantraturi]

pfa

[scao_FTNT]

2. in VPN, add gateway (FGT devices in this ADOM)---> which gateway option to select(external or managed)

   -- so you need to add a external gateway for Hub and managed gateways for Spoke for your 30D

4. after VPN created, system will auto generate hidden VPN zone interface for policy, so in policy package, create policies with these interfaces---> 3 zones are created vpnmgr_spoke2hub, vpnmgr_hub2spoke and vpnmgr_mesh, how do i create policies for spokes, can you give example explaining which interfaces to select

   -- since you only have spoke for config management in VPN, I think the policy you need is like internal/lan <-> vpnmgr_spoke2hub on your 30D (considering your VPN interface is binding to external/wan)

from error "Unsupported phase1 encryption for vpn testFortiGate-VM64[copy] (root)50%2015-10-10 10:27:37:vdom copy errorFortiGate-VM64", seems you are using FGTVM for testing? and does FGTVM have license and support you configured encryption method in VPN console?

Thanks

Simon

[hemantraturi]

Thanks Simon,

Yes i was testing on trial VM. When i replicated the configuration on live licensed appliance, it rolled out perfectly.