VPN between site to site

[AEF]

hello, 

I want juste to teste VPN between LAn and WAN like the attached file, can I do this ? 

the real problem for me is : - the vpn site to site IPSEC does not work, I followed this tutoriel

http://www.youtube.com/watch?v=xltPuIZT9uU

Thank you in advance for your help.

[emnoc]

A little more details would be helpful. But can you explain what/where the diagnostics fails?

PSK mismatch ? ( are you 100% sure PSK are correct on peers )

Acceptable Proposals ? ( 3des. aes128 192 256 or what ? )

ProxyID matches issues ? ( do they match peer 2peer )

fwpolicies issues ? ( is the policies correct, is the ordering correct )

is the vpn rt-based or policy-base ? ( if it's the former do you have routing confirmed ? )

Ken

[AEF]

Hello , 

I followed the exmple in the url bellow 

http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/IPSec/cb_ipsecvpn_fgt_basic.htm... 

8-  Go to Policy > Policy > Policy and select Create New to add a security policy for the IPsec VPN.    Source Interface/Zone internal Source Address HQ_net Destination Interface/Zone wan1 Destination Address Branch_net Schedule always Service ANY Action IPSEC VPN Tunnel HQ_to_Branch_p1

In this exemple, i created the phase 1 and phase 2 (HQ_to_Branch_p1  and HQ_to_Branch_p2 )

but the VPN tunnel does not appear in the choices

Why, 

Thank you in advance.

[Christopher_McMullan]

For most of the newer firmware releases, the GUI defaults to creating an interface-based IPsec VPN in Phase 1. You'll need to expand the Advanced section, and deselect Enable IPsec Interface Mode in order to use the Phase 1 in your action IPsec policy.

[AEF]

hello

A little more details would be helpful. But can you explain what/where the diagnostics fails?
PSK mismatch ? ( are you 100% sure PSK are correct on peers )
Acceptable Proposals ? ( 3des. aes128 192 256 or what ? )
ProxyID matches issues ? ( do they match peer 2peer )
fwpolicies issues ? ( is the policies correct, is the ordering correct )
is the vpn rt-based or policy-base ? ( if it's the former do you have routing confirmed ? )

in th HQ i used the following configuration: 

PSK mismatch ? ---> there is no mismatch in preshared key. Acceptable Proposals ? ---> Encryption : aes256 Authentication: SHA1                                       DH Group : 5                                        Keylife : 28800 ProxyID matches issues ? ---> I have this in : Quick Mode Selector :                         Source address: 10.10.10.0/24                        Destination address: 192.168.1.0/24  fwpolicies issues ? ---->             Source Interface/Zone: internal             Source Address: HQ_net             Destination Interface/Zone : Branch_net             Destination Address             Schedule: always             Service: ANY             Action: IPSEC             VPN Tunnel: HQ_to_Branch_p1 is the vpn rt-based or policy-base ? --->             I use a static route with the following             IP/Mask : 10.10.10.0/24              Gateway : 10.10.10.1             Distance: 10              Priority: 0                         I use a static route with the following             IP/Mask : 0.0.0.0/0              Gateway : 172.20.120.200             Distance: 10              Priority: 0

it is good configuration or not ?

thank you in Advance?

[emnoc]

Okay sorry for the tardy reply but based on the rt-based vpn and the next-hop I believe you have a problem.

is the vpn rt-based or policy-base ? --->             I use a static route with the following             IP/Mask : 10.10.10.0/24              Gateway : 10.10.10.1             Distance: 10              Priority: 0          

if your have rt-based your destination address should be pointed thru the named "phase1-interface"

Can you post your cfg?