fortigate ipsec s2s VPN with starlink ?

[morana]

hello every one .

recently we faced a problem with fortigate s2s with ADSL connections but , we solved it by changing PORT number and they are working great . thanks for all of you for helping .

the currrent config for SITE A and SITE B is as following :

site A: ADSL router ---> fortigate >vpn>IPSEC >site to site  > DDNS B >status : UP and can reach site B network

site B:ADSL router ---->fortigate >vpn>IPSEC >site to site   > DDNS A  >status : UP  and can reach site A network

Now , We are facing new problem which is  :

SITE A : As it is with above installation and configuration .

SITE B: changed from ADSL connection to star**bleep** connection and became lik this :

site B:Starlink router  ---->fortigate >vpn>IPSEC >site to site   > DDNS A  >status : Down Tunnel not Connected

.

i know there is NO port forwarding in starlink router and it is using CGNAT unlike ADSL .

i want to know how to solve this problem with the same configuration for both fortigate .

Do i need pfsens in site B to be in between :

Starlink--> pfsens ----(wireguard)---> fortigate -->etc ..

Or any another solutions ???

Thanks

[AEK]

Hi Morana

Hope this helps.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-Site-to-Site-Tunnel-configuration-Be...

https://community.fortinet.com/t5/Support-Forum/IPSEC-tunnels-behind-CGNAT-Starlink/td-p/226976

[morana]

thanks for the like , i will try that tomorrow and give u feedback...

[morana]

Hello AEK, i tried that but shows me in the tunnel A and B >  inactive ,but i can ping the siteA DDNS  form siteB and vise versa NOT. only DDNS pinging only not anything else .  !!!?? is this normal becoz it is DDNS ?

[AEK]

Hello Morana

I don't think this is due to DDNS. You can confirm if you verify that the DDNS resolves to the real public address of site B.

Anyway you don't need DDNS on site B, right? You need it only for site A and setup your aggressive mode & dialup VPN.

[Toshi_Esumi]

As @AEK showed, at least Site-B (Starlink) side should be able to initiate the tunnel to Site-A with agressive mode/dialup. But you mentioned "changing port". What exactly did you change.

Toshi

[morana]

hello man

NOT port i mean DNS protocol .

believe me i don't know what i am doing i was just playing around ....

under DNS protocol there is an option  :

(DNS UDP/53 protocol ) i enabled it. then it works directly ...

[Toshi_Esumi]

Ok. Did the Site-A FGT get the public IP DDNS A is showing?

Toshi

[morana]

As @AEK showed, at least Site-B (Starlink) side should be able to initiate the tunnel to Site-A with aggressive mode/dialup.

------------------------------------------------------------------------------------------------

You said with Site B dial up mode should initiate the connection, if i change to :

Remote > From DDNS to > Dial-up

with aggressive mod option .

OK, what about Site A , do i need to change anything else beside NAT traversal and aggressive mode ?

[Toshi_Esumi]

You have to change both sides for IPSec config. That should be in the docs. But Site-A needs to keep DDNS. Because, with agressive mode/dial up, only one side (Site-B:Starlink) initiate the tunnel to the DDNS-A FQDN. While Site-A never initiate because you remove the remote IP/FQDN from the config. Site-A FGT just waits until it gets the connection request from Site-B, then negotiation starts.

Toshi