VPN between CISCO R-C2900 to Forti 300C v5.0.7

[Anonymous5]

Hello,

I'm trying to set VPN tunnel between this two and no luck.

Any help would be appreciate.

Regards,

Andrey

[emnoc]

Search in this forum but here's 3 blog posting that describe a forigate to cisco vpn

http://socpuppet.blogspot.com/2014/05/site-2-site-vpn-fortinet-fortigate-to.html

http://socpuppet.blogspot.com/2014/05/howto-asr-ios-xe-to-fortigate-ikev2.html

http://socpuppet.blogspot.com/2014/05/howto-asr-ios-xe-to-fortigate-ikev2_22.html

These should help you and give you some ideals based on if you want  VTI or policybased on the cisco. YMMV on what want and need but either methods are workable with a fortigate.

As usual, I would recommend the route-based vpn model on the fortigate ( phase1-interface/phase2-interface ). Just ensure you place a "route" and have the correct fw-policies for the traffic in the encryption domain. if you are running the latest FortiOS, you  have a nice forti wizzard for vpn-creation to cisco.

[Anonymous5]

Hi,

Thanks for the links.

Actually I configured the VPN but with other example:

http://ciscofortigatevpn.blogspot.co.il/2013/04/fortigate-two-phases-cisco-router.html

But unfortunately I can associate only one map with the interface and there is already one VPN active.

Any ideas?

Regards,

Andrey

[emnoc]

That's no problem, you just make sequences # for each peer. You can define multiple peers with different policies and acls

e.g here's my  VXR

crypto map HQPN-VPN 10 ipsec-isakmp  set peer x.x.x.x  set transform-set  SET01  match address 101

crypto map HQPN-VPN 20 ipsec-isakmp  set peer x.x.x.x  set transform-set  SET01  match address 112

crypto map HQPN-VPN 30 ipsec-isakmp  set peer x.x.x.x  set transform-set  SRX-CUSTspottrade  match address 123

 set security-association lifetime seconds 9000  set pfs group14  set reverse-route distance 100  set reverse-route tag 102

crypto map HQPN-VPN 40 ipsec-isakmp  set peer x.x.x.x  set transform-set  backhauldr  match address 123

[Anonymous5]

Hi,

Thanks! I change a bit the configuration. Please review the logs:

#FROM-CISCO

SkyFX#show crypto ipsec sa

interface: GigabitEthernet0/0 Crypto map tag: To-DC, local addr 217.x.x.233

protected vrf: (none) local ident (addr/mask/prot/port): (192.168.95.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (172.30.2.0/255.255.255.0/0/0) current_peer 185.x.x.33 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0

local crypto endpt.: 217.x.x.233, remote crypto endpt.: 185.x.x.33 path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 current outbound spi: 0x0(0) PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:

#FROM-FORTI

# diag vpn tunnel list list all ipsec tunnel in vd 7 ------------------------------------------------------ name=VPN_2_CYPRUS ver=1 serial=1f 185.x.x.33:0->217.x.x.233:0 lgwy=static tun=tunnel mode=auto bound_if=103 proxyid_num=1 child_num=0 refcnt=6 ilast=23 olast=23 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=active on=0 idle=5000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 proxyid=2CYPRUS proto=0 sa=0 ref=1 auto_negotiate=0 serial=1 src: 0:172.30.2.0/255.255.255.0:0 dst: 0:192.168.95.0/255.255.255.0:0

Please advise.

Regards,

Andrey.

[emnoc]

Will  that does tell to much outside you don't have phase2 and as a matter of fact from what I can see, you don't have phase1 established.

I would like refer you to a simple vpn t-shoot tutorial

http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html