{"id":2523,"date":"2018-07-02T15:47:38","date_gmt":"2018-07-02T15:47:38","guid":{"rendered":"http:\/\/rachmadona.net\/?p=2523"},"modified":"2018-07-02T15:47:38","modified_gmt":"2018-07-02T15:47:38","slug":"how-to-setup-ipsec-vpn-between-fortigate-mikrotik-part-3-end","status":"publish","type":"post","link":"https:\/\/rachmadona.net\/?p=2523","title":{"rendered":"How to Setup IPSEC VPN Between Fortigate & MikroTik – Part 3 (End)"},"content":{"rendered":"

This post is the last sequel from previous post here<\/a> and here<\/a>.<\/p>\n

Last time we had configure IPSEC VPN for remote site used MikroTik router. Now, the time has come. We will configure Fortigate on the main site.<\/p>\n

Just go thru VPN -> IPsec Wizard and select custom<\/p>\n

\"\"<\/p>\n

Put the proper tunnel name along with remote site Public IP. Use outgoing WAN interface (do not use load balance WAN as it might lead asymmetric routing).<\/p>\n

\"\"<\/p>\n

Use the same PSK as we have used before on MikroTik. In addition make sure same encryption being used along with DH group. These settings to define phase one proposal.<\/p>\n

\"\"<\/p>\n

For phase 2 proposal you may need to determine source and destination address and expand the advance dialog box on left bottom and fill all values as seen on pic below.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

It’s done. Now you can see the tunnel status still being seen inactive.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

If we can see from the MikroTik log, it shows an error “phase1 negotiation failed due to time up” meanhwile there is an error as well from Fortigate side.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

“No policy configured” means we might need to create a firewall rule for this VPN connection. Go to Policy & Objects – IPv4 Policy then create rule to allow incoming traffic from VPN to connect internal LAN. Here in example below shown VPN connection could access server farm subnet (192.168.0.0\/24).<\/p>\n

\"\"<\/p>\n

Post that you will found VPN connection has been established. Phase 1 and phase 2 established successfully.<\/p>\n

\"\"<\/p>\n

From Fortigate log seen IKE protocol could inter-exchange with remote site and there is R-U-THERE & R-U-THERE-ACK which indicated three way handshake for IPSEC has running properly.<\/p>\n

\"\"<\/p>\n

Back to IPSEC monitor, now you found everything seen up and running.<\/p>\n

\"\"<\/p>\n

But somehow when you tried to ping end device on remote site it did not respond, otherwise it comes with unreachable packet occur.<\/p>\n

Same goes from remote site where you unable to reach everything on the head office site.<\/p>\n

\"\"<\/p>\n

Till here all you can only do is just to add the routing from Fortigate side. Go to Network then choose Routing. Add static routing as depicted below.<\/p>\n

\"\"<\/p>\n

Do not forget to allow source connections with destination of VPN connection. It is a mandatory since it won’t you to proceed with packet traverse.<\/p>\n

\"\"<\/p>\n

Eventually both remote site and head office are could reach each other and packets traverse in between.<\/p>\n

Ciao!<\/p>\n

**For some reason you might implement multiple IP on single interface and uses for VPN gateway. This may leads into an error \u201cno SA proposal chosen\u201d and there is additional thing for fixing out this issue by adding following command set local-gw (Secondary Public IP).<\/span><\/i><\/p>\n","protected":false},"excerpt":{"rendered":"

This post is the last sequel from previous post here and here. Last time we had configure IPSEC VPN for remote site used MikroTik router. Now, the time has come. We will configure Fortigate on the main site. Just go thru VPN -> IPsec Wizard and select custom Put the proper tunnel name along with…<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,40,11],"tags":[187,242,276,477,479],"class_list":["post-2523","post","type-post","status-publish","format-standard","hentry","category-fortigate","category-mikrotik","category-network","tag-fortigate","tag-ipsec","tag-mikrotik-2","tag-vpn","tag-vpn-site-to-site"],"_links":{"self":[{"href":"https:\/\/rachmadona.net\/index.php?rest_route=\/wp\/v2\/posts\/2523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rachmadona.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rachmadona.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rachmadona.net\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/rachmadona.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2523"}],"version-history":[{"count":0,"href":"https:\/\/rachmadona.net\/index.php?rest_route=\/wp\/v2\/posts\/2523\/revisions"}],"wp:attachment":[{"href":"https:\/\/rachmadona.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rachmadona.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rachmadona.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}