Remember to postpone an higher distance blackhole route to 10.5.1.0/24 to avoid routing loops when the dial-up tunnel is down.Īdd address=10.5.1.254/24 interface=bridge1 network=10.5.1.0 -> Local Subnet on FortiOS sideĪdd address=10.3.1.13/24 interface=ether1 network=10.3.1.0 -> Subnet providing RouterOS Internet access (behind the NAT)Īdd auth-algorithms=md5 disabled=no enc-algorithms=3des lifetime=1h name=fase2Īdd address= /32 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=2m enc-algorithm=3des exchange-mode=ike2 generate-policy=no hash-algorithm=sha1 lifetime=1d my-id=key-id:User01 policy-template-group=default secret=Mescal&Ladroni send-initial-contact=yesĪdd action=encrypt disabled=no dst-address=172.24.1.0/24 dst-port=any ipsec-protocols=esp level=require proposal=fase2 protocol=all sa-dst-address=109.233.220.175 sa-src-address=0.0.0.0 src-address=10.5.1.0/24 src-port=any tunnel=yes When the Dial-Up tunnel is down the route disappears. Once the Dial-Up VPN is up and running the FG automatically installs a static-route 10.5.1.0/24 via Dial-Up-IPSec interface. In this Dial-Up scenario there's no need (and possibility) to configure explicit static-routing. Set dstaddr "172.24.1.0/24" -> Local Subnet on FortiOS side Set srcaddr "10.5.1.0/24" -> Local Subnet on RouterOS side
Hence I have configured only one policy for this dierction) Set dst-subnet 10.5.1.0 255.255.255.0 -> Local Subnet on RouterOS sideįG80C # config firewall policy (in my case I want only RouterOS side to contact the FG80C side. Complete the configuration before beggining with tests.įind below the CLI configuration for both devices.
In contrast RouterOS bring you into thinking to "build&test" step-by-step, Phase1 then Phase2 then Policies. The main source of mistake was that the FG wants everything (Phase1, Phase2 and Firewall Policies) all correctly configured before any test can take place. If you're still interested contact me and I'll be happy to show the way I did. Good evening all, I've finally managed to have this scenario working: RouterOS (6.40.4) behind a NAT is now able to open IPSec SA to a FG80C (5.6), the traffic is routed.
0 kommentar(er)
