Fortinet: Troubleshoot 5 IPSec Site-to-Site VPN Scenarios - FortiGate

[@jobyit]

Brilliant, this would really help FortiGate engineers to fix all the s2s related issues.Awesome.......

[@mycablebox205]

newbie to fortigate, this video resolved my site-to-site vpn issue

[@sk19835]

In our organization since 10 days one issue coming...firewall suddenly becomes unreachable and when we make 1 tunnel disable then only it comes up...for 15 location this is issue...can u guide what could be issue

[@aarushsingh2006]

It was really to the point. Thanks mate.

[@adriantepes-qu8wm]

When you create a tunnel in Fortigate, do you have to explicitly create a firewall rule to say allow traffic (port 500, 4500) from remote gateway IP to your firewall's Public IP ?

[@tothepointfortinet3823]

No you do not need a rule for port 500 or 4500(this is traffic to/from the actual fortigate itself which is implicitly allowed by default via local in policy) . What is required is a firewall policy referencing the ipsec tunnel interface (if that's missing then fortigate won't establish a tunnel)

[@adriantepes-qu8wm]

@@tothepointfortinet3823 tnx

[@vikasnayak4899]

It will help to solve S2S issues thank you

[@khaledBouafia-p3p]

very good explanation

[@bjaspidey]

Excellent video!

[@MahmoudMohamed-si3by]

Excellent

[@loidrama4721]

Sir my problem is that all Connections are up but no Incoming Data and Outgoing data were made.

[@tothepointfortinet3823]

Might want to check firewall policy config, ipsec selectors and routing config. If you still have trouble check out my video on sniffer. Then it might be good to call support

[@arashvermahmood7961]

just great. thanks for sharing.

[@amitkoolmar]

Amazing content! Thanks so much!

[@raikone14]

tks, nice vide, if you allow me to make a question, if nat t is enable I should expect traffic in port 500 as well in phase1 ? or 4500 ? I am confuse

[@tothepointfortinet3823]

Yes, you should always expect traffic on port 500 regardless of NATT, NATT is specific to phase2 Here's the ports/protocols to expect depending on whether NATT is in use or not: NATT NOT being used: phase1 = UDP 500 phase2 = ESP (ie. IP protocol 50) NATT being used: phase1 = UDP 500 phase2 = UDP 4500

[@raikone14]

@@tothepointfortinet3823 tks a lot for the reply..you are a nice person :)

[@CiZiK22]

Interesting video, well done ! Thanks

[@Quick_UnBoxing0]

Amazing 🎉

[@jayanvv-oi8hp]

great content 🤝

[@ravishere-mn6no]

Thank you very much for the video !!

[@smile-w5d]

great job, tks!

[@michaelcarreira2638]

Wow what great content!

[@netadministrator1371]

i already creat site to site.its successful to connect but the other side i cant ping thier ip (local ip's).

[@arshidibrahim3781]

Kindly turn off that system firewall and ping

[@carloscortes8761]

i love ti, thanks

[@netconfig999]

thanks for sharing

[@diwakarsawant_]

Good 🎉

[@ernof4271]

thanks mate, very usefull information for me

[@murugansridhar7909]

❤

[@shijugopinathan1086]

Thanks

[@Zdawoud]

Thanks (Y)