VPN tunnel not automatic up

[#1]

Hi Still working on my problem with VPN. Following situation: I configured a VPN with a remote service provider. When I bring the VPN with the monitor up the VPN works With the regarding policy (destination address specified, Action is IPSEC, policy is the first in the list) nothing happens. All pings don' t reach the server and traceroute ends from an internal client at the internal interface of the fg100a. I don' t understand why the tunnel does not go up. Only special thing in this configuration is, that I need special source adresses for the provider. So I used th quick mode selector and defined the proxy sources and destinations. Any help or idea is welcome. Try to solve the problem sind 9 o' clock in the morning (now 8 hours) Thanks Oliver

[abelio]

Hi, there' s no problem for FTG either to manage translations, but i think the problem is that your peer restricted this to a /29 and you need vpn services for a /24 subnet Did you tried ping other side with your ipsec policy " natoutbound" checked AND " use-natip disable" phase2 with source 192.168.x.1...6 ? Maybe anyone could help or we' re missing something else here?

[red_adair]

just to make sure: Your default GW (or a static route) that points to the Remote-Network hast to point to your WAN Interface. So traffic will be routed to the WAN Interface where it' s beeing catched by the VPN Policy and put into the Tunnel. You likely do not have to deal with NAT at all since you' re simply routing between 2 networks. Also make sure that the return-route is also set on the far end. -R.

[#4]

Hi, many thanks to you, abelio and red.adair, for your advices. @abelio: Yes I tried this. The problem is, that the vpn is not established if I come in with another source than the 10.172.x.x. The provider also deals with policies. If there is another source than 10.172.x.x the vpn could not be established at all. @red.adair: I agree to your opinion. Normally it is just a LAN-LAN interconnection. So normally it should work with routing entries. The question for me is, when I define the policy that everything that goes to 10.192.x.x should be encrypted an should go through the tunnel normally this should be my first route. Independent of all other routes the vpn should go up, and if it only tries - but it should go up. OK. If it only goes up when the routes are OK the next question is, how does the FG knows that everything from the 10.192.x.x should be rerouted to the internals lan?? Where is the relationship between my internal lan and the proxy sources I have to specify?? If there would be a way to setup a relationship between let' s say 192.168.1.45 with 10.172.x.249 then I could imagine that this could work. Or if could work there with routes then I think there would be a way. Maybe you have an idea!?! I' m a little bit frustrated. I alway hear the same answers from the provider. There is no problem with CISCO or LANCOM. Good and correct information - because they sell this routers. Thanks for your endeavors.