VPN Tunnel With Remote Site ISP That Is Shared

[BWiebe]

Hey all,

I am setting up a number of Fortigate 50E firewalls for a number of remote sites that are running 5.4.1.

Some of these sites we have direct control/access to the local ISP connection and I'm not worried about these.  I'll have no issues setting up VPN tunnels between these sites and the other sites they will need network access to.

For a couple of sites, we will be putting their device on a shared internet connection where they are given a private IP and we have no access to the configuration on the device that provides the public IP.

We have a need to setup IPSEC VPN between these sites and sites we have full control over.  We'd ideally like to be able to get into the devices on these sites using these IPSEC VPN but it's not a deal-breaker if we can't as we will also have PCs at these sites that have alternate remote access functionality that we could take advantage of, worst case.

I've done some testing with using Dynamic DNS setup and IPSec VPN and that seems to partly work, but unless I can setup a NAT on the public side, I can't see a way I could access the network remotely through this VPN.

Any thoughts on the best way to set this up would be appreciated.

Thanks!

[ede_pfau]

been there, done that...the way to go is to set up a dial-in VPN so that the remote FGT opens up the tunnel. Administration is no problem then.The only requirement is that the router in front of the remote FGT must pass all traffic, i.e. not intercept ESP (like some FritzBoxes used to do).

The VPN will be of type "aggressive", "main mode" doesn't work if the remote side just offers a private address.

For multiple sites, use peerID/remoteID identifiers. Even if you only have one site of this kind at this time it pays off to configure the HQ FGT right from the start.

You can put the remote IDs and their PSKs into 'local users' and use the user group for authentication for the one and only dial-up VPN on the HQ FGT. Works perfectly.

[emnoc]

Even if you only have one site of this kind at this time it pays off to configure the HQ FGT right from the start.

Thumbs up on the above and  to add   "ensure the  upstream device allows IKE  NAT-T. You might have to play around with IKE-KAs."

[&:]