Technical Tip: IPsec Site-to-Site Tunnel configuration Between Sonicwall and FortiGate (behind CGNAT Starlink) - Optimal Configuration Scenario

[Umer221]

Description	This article provides a replica of a functional configuration for a site-to-site VPN that consistently encounters issues in both Phase 1 and Phase 2 negotiations when connecting between SonicWall and a FortiGate connected behind CGNAT Starlink.
Scope	FortiOS, FortiGate, Sonicwall, CGNAT Starlink.
Solution	Firstly, make sure that all of the basic configuration is matching both sides using this article. If the basic configuration does not help bringing the IPsec tunnel up using the above article, the following changes must be made on both sides of the tunnel: Enable Forced NAT Traversal (NAT-T) on both sites under VPN -> IPsec Tunnels.    Switch to IKEv1 -> Aggressive Mode: Test the tunnel and refer to this article to enable MTU override and disable Anti-Reply if tunnel still shows offline. Related article: Technical Tip: Explaining IPsec Anti-replay and preventing packet drops.