Comunidad FORTIGATE.es

Estimados:

Favor vuestra ayuda, soy nuevo en esto de la creacion de VPN.
Cree una VPN IPSec en Firewall 110C, la VPN cierra y me entrega IP por DHCP, pero no tengo conectividad desde el rango IP DHCP a red detras del Firewall.
No se si es un tema de Policy o que configure mal la VPN.

hola, tendriamos que revisar la config.
podrias mostarrla? vpn, rutas y politicas

saludos.

gabyrossi escribió:hola, tendriamos que revisar la config.
podrias mostarrla? vpn, rutas y politicas

saludos.

Estimada

Te anexo la configuracion de la VPN
INTERFACES
edit "port1"
set vdom "root"
set ip 172.16.1.1 255.255.255.0
set allowaccess ping https ssh snmp http telnet
set type physical
set alias "Internal"

edit "port8"
set vdom "root"
set ip 200.29.222.172 255.255.255.248
set allowaccess ping https ssh snmp http telnet
set type physical
set alias "INTERNET"

edit "ipsec_test"
set vdom "root"
set type tunnel
set interface "port8"

REDES
config firewall address
edit "all"
next

edit "access_network"
set subnet 172.16.1.0 255.255.255.0
next

edit "ipsec_network"
set subnet 10.10.20.0 255.255.255.0

RUTAS
config router static
edit 1
set device "ipsec_test"
set dst 10.10.20.0 255.255.255.0

edit 2
set comment "Salida Internet"
set device "port8"
set gateway 200.29.22.169

DHCP
edit 1
set auto-configuration disable
set default-gateway 200.29.222.169
set dns-service default
set interface "ipsec_test"
config ip-range
edit 1
set end-ip 10.10.20.110
set start-ip 10.10.20.101
next
end
set netmask 255.255.255.0
set server-type ipsec
set ipsec-lease-hold 0

VPN
config vpn ipsec phase1-interface
edit "ipsec_test"
set type dynamic
set interface "port8"
set xauthtype auto
set mode aggressive
set mode-cfg enable
set proposal 3des-sha1 aes128-sha1
set authusrgrp "ipsec_group"
set ipv4-start-ip 10.10.20.101
set ipv4-end-ip 10.10.20.110
set ipv4-netmask 255.255.255.0
set dns-mode auto
set psksecret ENC E9D/CGLSfkS5rjIQZ/qUWMsGoTTf7+uLckeccTYXx5eMxGXlhNGEbMU/eTi3OFJJiHmkqPZy+TvL8xgOxkZd7jCC3AD1nXt3ssM8sEOori8fqN3U
next
end

config vpn ipsec phase2-interface
edit "ipsec_test"
set phase1name "ipsec_test"
set proposal 3des-sha1 aes128-sha1


POLICY
config firewall policy
edit 1
set srcintf "ipsec_test"
set dstintf "port1"
set srcaddr "ipsec_network"
set dstaddr "access_network"
set action accept
set schedule "always"
set service "ANY"
set logtraffic enable
next

edit 2
set srcintf "port1"
set dstintf "ipsec_test"
set srcaddr "access_network"
set dstaddr "ipsec_network"
set action accept
set schedule "always"
set service "ANY"
set logtraffic enable
next

edit 3
set srcintf "port1"
set dstintf "ipsec_test"
set srcaddr "access_network"
set dstaddr "all"
set action accept
set schedule "always"
set service "DHCP"
set logtraffic enable
next
end

hola, no necesiats dhcp en la interface de vpn, porque ya se lo estas dando en la phase1.

reviaste los videos que hay en [Debes identificarte para poder ver enlaces.] ???

[Debes identificarte para poder ver enlaces.]

[Debes identificarte para poder ver enlaces.]

saludos.