IPSEC tunnel Fortinet Transparent Mode to inside Fortinet firewall in NAT Mode does not respond to i

Posted by TrevJen on Server Fault See other posts from Server Fault or by TrevJen
Published on 2010-03-25T22:05:38Z Indexed on 2010/03/25 22:13 UTC
Read the original article Hit count: 484

Filed under:

fortinet

|

ipsec

|

routing

|

firewall

|

nat

I have 2 fortinet firewalls (fully patched); fw1 is providing an IPSEC tunnel in transparent mode. beneath this firewall is a fw2, a NAT firewall with a VIP address that has been confirmed to work. This configuration is required for my customers who want to connect to a public address space inside of the tunnel, in order to prevent cross over in IP space. This configuration works great for traffic going outbound to the remote side of the tunnel, but not inbound. While sniffing the traffic, I can see the inbound traffic going out of the fw1, but it is never seen at the fw2.

Cust Net > 10.1.1.100                         
                |
                |
                |
FW1      >TRANSPARENT IPSEC
                |
                |
                |
FW2 EXT  >99.1.1.1.100-VIP
                |
FW2 NAT  >192.1.1.100-NAT

© Server Fault or respective owner

Related posts about fortinet

Fortinet SSL VPN Client Setup Without GUI on Linux (centos)

as seen on Server Fault - Search for 'Server Fault'
How can I install and setup a fortinet SSL VPN client on a VPS that's running on Centos? I have problem to do it because all guide I have are all using GUI which is not installed on the VPS to save resource. (example: http://dbssolutions.freshdesk.com/solution/categories/1513/folders/3047/articles/1791-how-to-install-the-linux-fortinet-ssl-vpn-client) I… >>> More
IPSEC Windows 2008 <--> Fortinet 60B

as seen on Server Fault - Search for 'Server Fault'
I am trying to establish a IPSEC vpn, between an office DSL connection and a single virtual machine. I have done hub-spoke stuff before with cisco and fortinet routers, never hardware <-- software. Fortigate 60B - 10.20.1.1/24 Windows Server 2008 r2 Installed On VM I have seen some guides… >>> More
Connect to a Fortinet VPN with Ubuntu

as seen on Server Fault - Search for 'Server Fault'
I don't know a lot about VPNs but I'd like to connect to a Fortinet VPN with Ubuntu. I can connect on Windows using Forticlient just by entering the policy server (vpn.theserver.com) and then it asks for a user/password. I use IPSec. >>> More
IPSEC tunnel Fortinet Transparent Mode to inside Fortinet firewall in NAT Mode does not respond to i

as seen on Server Fault - Search for 'Server Fault'
I have 2 fortinet firewalls (fully patched); fw1 is providing an IPSEC tunnel in transparent mode. beneath this firewall is a fw2, a NAT firewall with a VIP address that has been confirmed to work. This configuration is required for my customers who want to connect to a public address space inside… >>> More
Fortinet: Is there any equivalent of the ASA's packet-tracer command?

as seen on Server Fault - Search for 'Server Fault'
I would like to know if there is not Fortigates an equivalent of the packet-tracer command that we can find on the ASA. Here is an example of execution for those who don't know it: NAT and pass : lev5505# packet-tracer input inside tcp 192.168.3.20 9876 8.8.8.8 80 Phase: 1 Type: ACCESS-LIST Subtype:… >>> More

Related posts about ipsec

Ipsec reload fails to load ipsec.conf Strongswan 5.0

as seen on Server Fault - Search for 'Server Fault'
I am having trouble configuring a connection to an Android device using a fedora 17 linux machine and strongSwanv5.0.1dr2. I have made some progress but when I try adding the configuration to support xauth authentication I receive an error when I try to reload the configuration file. I get a similar… >>> More
Specify IPSEC port range using ipsec-tools

as seen on Server Fault - Search for 'Server Fault'
Is it possible to require IPSEC on a port range ? I want to require IPSEC for all incoming connections except a few public ports like 80 and 443, but don't want to restrict outgoing connections. My SPD rules would look like: spdadd 0.0.0.0/0 0.0.0.0/0[80] tcp -P in none; spdadd 0.0.0.0/0 0.0.0.0/0[443]… >>> More
Connecting debian and windows via IPsec VPN with Racoon and ipsec-tools

as seen on Server Fault - Search for 'Server Fault'
I've some trouble with the IPsec configuration on my debian server (6 squeeze). This server should connect via IPsec VPN to an windows server, which is protected by an firewall. I've used racoon and ipsec-tools and this tutorial http://wiki.debian.org/IPsec. However, I am not quite sure, if this… >>> More
ASA hairpining: I basicaly want to allow 2 spokes to be able to communicate with each other.

as seen on Server Fault - Search for 'Server Fault'
ASA Spoke to Spoke Communication I have been looking at spke to spoke comms or "hairpining" for months and have posted on numerouse forums but to no avail. I have a Hub and spoke network where the HUB is an ASA Firewall version 8.2 * I basicaly want to allow 2 spokes to be able to communicate with… >>> More
Can't get the L2TP IPSEC up and running

as seen on Server Fault - Search for 'Server Fault'
i have an Ubuntu 11.10 (oneiric) server running on a ReadyNAS. Im planning to use this to accept ipsec+l2tp connections through a router. However, the connection is failing somewhere half through. Using Openswan IPsec U2.6.28/K3.0.0-12-generic and trying to connect with an iOS 5 iPhone 4S. This is… >>> More