VPN IPSec Between Fortigate and Cyberoam

[achmad_nurfajri]

Hello Master. 

i have a fortigate  60D and a Cyberoam, and i had been configure VPN IPSec between it. 

the VPN is connected but i cant access the computer (RDP, PING, WEB, HTTPS) in the other side. 

i try to allow connection in filter rule in the both side, but i still cant access.

i try step by step in this link, and still cant access

[link]https://kb.cyberoam.com/default.asp?id=1945[/link]

any suggestion for my case? some tutorial link or something i must to do.  Thanks Very Much

[neonbit]

I'm assuming you're trying to connect from the FGT side to the RDP server on the Cyberoam side.

First thing I would recommend is the diag debug flow command on the FGT side. This will determine if the FGT is sending the packets over the VPN, if it is then you'd have to look at troubleshooting on the Cyberoam.

On the FGT run the following commands:

diag debug flow filter daddr RDPserversIPaddress

diag debug flow show console enable

diag debug enable

diag debug flow trace start 3

After this try to RDP to the server and see what comes up. Confirm that the policyID matches the correct one and the route selected uses the IPSEC interface.

FYI more details on the debug flow command can be found here: http://kb.fortinet.com/kb...teId=0%200%20103849130

[achmad_nurfajri]

Dear Neobit, 

i have been selected IPSec interface in route

I try what you said.

this is the result.

My fortinet side is 20*.***.***.*** and cyberoam side is 2**.***.***.***

2017-04-07 10:13:11 id=20085 trace_id=213 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 172.16.50.10:61998->172.16.2.51:3389) from internal. flag , seq 2459043432, ack 0, win 8192"

2017-04-07 10:13:11 id=20085 trace_id=213 func=init_ip_session_common line=4569 msg="allocate a new session-00d6d0f9"

2017-04-07 10:13:11 id=20085 trace_id=213 func=vf_ip4_route_input line=1586 msg="Match policy routing: to 172.16.2.51 via ifindex-69"

2017-04-07 10:13:11 id=20085 trace_id=213 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-172.16.2.51 via VPN_GSS"

2017-04-07 10:13:11 id=20085 trace_id=213 func=fw_forward_handler line=671 msg="Allowed by Policy-27:"

2017-04-07 10:13:11 id=20085 trace_id=213 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-VPN_GSS"

2017-04-07 10:13:11 id=20085 trace_id=213 func=ipsec_output_finish line=232 msg="send to 203.77.224.121 via intf-wan1"

2017-04-07 10:13:11 id=20085 trace_id=213 func=esp_output4 line=897 msg="encrypting, and send to 20*.***.***.***with source 2**.***.***.***"

2017-04-07 10:13:14 id=20085 trace_id=214 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 172.16.50.10:61998->172.16.2.51:3389) from internal. flag , seq 2459043432, ack 0, win 8192"

2017-04-07 10:13:14 id=20085 trace_id=214 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-00d6d0f9, original direction"

2017-04-07 10:13:14 id=20085 trace_id=214 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-VPN_GSS"

2017-04-07 10:13:14 id=20085 trace_id=214 func=ipsec_output_finish line=232 msg="send to 203.77.224.121 via intf-wan1"

2017-04-07 10:13:14 id=20085 trace_id=214 func=esp_output4 line=897 msg="encrypting, and send to 20*.***.***.***with source 2**.***.***.***"

2017-04-07 10:13:20 id=20085 trace_id=215 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 172.16.50.10:61998->172.16.2.51:3389) from internal. flag , seq 2459043432, ack 0, win 8192"

2017-04-07 10:13:20 id=20085 trace_id=215 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-00d6d0f9, original direction"

2017-04-07 10:13:20 id=20085 trace_id=215 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-VPN_GSS"

2017-04-07 10:13:20 id=20085 trace_id=215 func=ipsec_output_finish line=232 msg="send to 203.77.224.121 via intf-wan1"

2017-04-07 10:13:20 id=20085 trace_id=215 func=esp_output4 line=897 msg="encrypting, and send to 20*.***.***.***with source 2**.***.***.***"

and i still dont get it. 

any something wrong?

thanks before.

[harsh]

Try these settings at cyberoam end to create new policy, AND USE THIS POLICY TO CREATE TUNNEL

KEYING METHOD :- AUTOMATIC ALLOW RE-KEYING :- ENABLE KEY NEGOTIATION TRIES :- 5 AUTHENTICATION MODE :- MAIN MODE PASS DATA IN COMPRESS MODE :- DISABLE PERFECT FORWARD SECRECY PFS :- ENABLE PHASE 1 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM SHA1 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM MD5 DH GROUP :- 5 AND 14 KEY LIFE :-86400 REKEY MARGIN :- 120 RANDOMIZE RE-KEYING MARGIN BY :- 0 DEAD PEER DETECTION :- ENABLE CHECK PEER AFTER EVERY :- 30 SECOND WAIT FOR RESPONSE UPTO :- 120 SECONDS ACTION WHEN PEER UNREACHABLE :- RE-INITIATE PHASE 2 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM SHA1 ENCRYPTION ALGORITHAM 3DES WITH AUTHENTICATION ALGORITHAM MD5 PFS GROUP ( DH GROUP ) :- SAME AS PHASE-1 KEY LIFE :- 43200

--------------------------------

after creating tunnel add rule for lan to vpn and vpn to lan traffic in cyberoam firewall

foritigate firewall os ver. 5.4 and cyberoam ver 10+

[emnoc]

Match the same  parameters for phas1/2 ,  but what you need todo is collect 1st diagnostic for vpn tunnel list and diag debug flow outputs.

http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html

for cyberoam review the logs for details.

2nd, you need to ensure the static route is applied for the  target remote-subnet on the  fortigate ( cyberoam does this automatic )

3rd ensure the local/remote-subnets are defined. DO NOT USE  quad 0s  ( i.e 0.0.0.0/0:0 )

[harsh]

1. Add vpn to lan rule in cyberoam

2. Add lan to vpn rule in cyberoam

Note :- allow all( user and ip's) and all services  in vpn rules