Thank you @Rejo-ni3hz, I try to be rooted in theory but apply practical application so that anyone can easily understand, I’m glad the content is achieving that…😀 thank you for being part of this community..
i have a challenge. A tunnel has failed to come up between Fortigate and Linux server running strongSwan. The Fortigate has NAT-T enabled and they are translating their external IP from Private to Public. Can you assist.
Hi @mrmendes4ever, I assume you have NAT-T enabled on the StrongSwan as well? From Fortigate try to run the following and observe output: 1. get vpn ipsec tunnel summary we are interested in status: selectors(total,up).. 2. diagnose sniffer packet any 'host x.x.x.x' 4 we want to see bidirectional IKE exchange, be sure to use the public address of the StrongSwan. 3. diagnose vpn ike gateway list name "tunnel-name" or simply diagnose vpn ike gateway list if there's only 1 tunnel The idea is to see what status phase 1 tunnel is in: connecting or Established. Then we can take it from there..
Assuming the 2 devices are in fact correctly exchanging IKE and UDP/500 UDP/4500 and ESP are not blocked anywhere, try this to see what the peers are disagreeing on: - diagnose debug application ike -1 observe the output and hopefully this leads us to the root cause. Best of luck!
Hey everyone, this has been the second video on the VPN topic, I value your feedback, let me know your thoughts...!
Not many people can explain clearly like this, good job!
Thank you!
Thanks. You have explained so simple
The best video I ever seen
thank you very much ...
You're better than my teachers
Thank you @Rejo-ni3hz, I try to be rooted in theory but apply practical application so that anyone can easily understand, I’m glad the content is achieving that…😀 thank you for being part of this community..
Could you please share packet flow in fortigate firewall
Yea I’m definitely doing a video on that soon…
i have a challenge. A tunnel has failed to come up between Fortigate and Linux server running strongSwan. The Fortigate has NAT-T enabled and they are translating their external IP from Private to Public. Can you assist.
Hi @mrmendes4ever, I assume you have NAT-T enabled on the StrongSwan as well?
From Fortigate try to run the following and observe output:
1. get vpn ipsec tunnel summary
we are interested in status: selectors(total,up)..
2. diagnose sniffer packet any 'host x.x.x.x' 4
we want to see bidirectional IKE exchange, be sure to use the public address of the StrongSwan.
3. diagnose vpn ike gateway list name "tunnel-name" or simply diagnose vpn ike gateway list if there's only 1 tunnel
The idea is to see what status phase 1 tunnel is in: connecting or Established.
Then we can take it from there..
Assuming the 2 devices are in fact correctly exchanging IKE and UDP/500 UDP/4500 and ESP are not blocked anywhere, try this to see what the peers are disagreeing on:
- diagnose debug application ike -1
observe the output and hopefully this leads us to the root cause.
Best of luck!