I use the Fortigate60E as firewall and router behind a DSL modem. The FGT is connected to the DMZ port of the DSL modem (FritzBox 7360). I'm able to log in to the FritzBox on port 442, and the management port of the FGT is HTTPS: 444. I'm also able to login to the FGT from a remote desktop. The Physical settup is: Internet (public IP) <--> Frtizbox (192.168.1.1) <--> (192.168.1.20) Fortigate 60E <--> (192.168.2.1/24) Lan Clients. The Lan Clients is on port 2 (as Interface, not as LAN port).
port 2 (internal1) has static IP adress 192.168.2.1 with DHCP Server (s.i.p: 192.168.2.10, e.i.p: 192.168.2.254) no Secondary IP Address. The wan1 interface has addressing mode: DHCP (from FritzBox, which assigns static IP address: 192.168.1.20) with Acquired DNS 192.168.1.1 and Default Gateway: 192.168.1.1 (= FritzBox LAN port 1). Retrieve default gateway from server is on and Override internal DNS is also on.
I'm also able to port forward VOIP settings to a local PBX server and WebDav ports to a NAS in the local network. When I create a IPSec tunnel with the IPSec Wizard and choose for Remote Access and Windows Native, and fill in all settings:
2) Incoming Interface: Wan1 (192.168.1.20), Pre-shared key, User Group (VPN-Users)
3) Local interface: Lan-Clients (192.168.2.1/24), Local Address: all, Client Address Range: 10.10.100.1-10.10.100.100, Subnet Mask: 255.255.255.255
When I try to connect from remote Client I see the tunnel is coming up, but the VPN Events only are showing negotiate failures on the IPSec phase 1 connector.
What should I do to make this work?? I've spend days searching the Forti Cookbook and forums and Youtube video's, but it won't work..
Please help!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Jining,
Than I think that'll be the issue. If the FGT is connected to the Internet direct, we've no problem, If connected to DSL router (as an exposed host, so all ports will be forwarded to FGT), we have to deal with the double NAT problem.
I've attached a log file when trying to connect with the L2TP-IPSec vpn to the FGT.
Hope you can see someting in it?
Thanks alot!
How can I log the packet capture files for both ports?
One more update:
Setting up a PPTP connection isn't a problem. Also a SSL-VPN connection isn't a problem, only the L2TP-IPSec vpn connection is a problem.
I have to little knowledge of VPN protocols to choose between these 3 protocols. After searching many days on the internet I find the IPSec (over L2TP) protocol should be the fastest one and maybe also the most secure one?
Again thanks for the support!
Try changing the near end selector (network) to the public IP of the DSL box.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Hello Bob,
Thank you for your reply!
I'm just a starter with Fortinet, and don't understand well what you mean... Can you please explain a bit more what you mean by changing the near end selector? How should I do that?
Thank you.
Hi Leander,
From you debug, we can see ISAKMP SA negotiation failure.
Would you post the following FGT config?
show vpn ipsec phase1-interface
show vpn ipsec phase2-interface
show vpn l2tp
Hi Leander,
Thanks for your config.
It looks like phase1 proposal and dh group doesn't match the incoming one.
I suggest you add the following proposal to phase1 and phase2 config and change phase1 dhgrp to 5.
3des-sha256 aes128-sha256 aes192-sha256
Regards,
Jining
Hi Jining,
It looks like you've helped me one step further!!
First I got a Phase1 negotiation error (see attached file), with the dhgrp set to 5 now phase 1 isn't giving a problem. But now I get a negotiation error on phase 2. I'll post that picture in the next post.
Hope that can be solved also...
Thank you!
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1468 | |
1007 | |
748 | |
443 | |
206 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.