fortigate-ipsec-40-mr3

Gateway-to-gateway configurations Testing
Testing
To configure the IPsec security policy
In the CLI on FortiGate_1, enter the commands:
config firewall policy
edit 1
set srcintf "port1"
set dstintf "port2"
set srcaddr "vpn-local"
set dstaddr "vpn-remote"
set action ipsec
set schedule "always"
set service "ANY"
set inbound enable
set outbound enable
set vpntunnel "FGT1_to_FGT2"
set natoutbound enable
set natip 10.31.101.0 255.255.255.0
end
Optionally, you can set everything except natip in the web-based manager and then
use the CLI to set natip.
Enter the same commands on FortiGate_2, but set natip be 10.21.101.0
255.255.255.0.
The best testing is to look at the packets both as the VPN tunnel is negotiated, and when
the tunnel is up.
To determine what the other end of the VPN tunnel is proposing
1 Start a terminal program such as puTTY and set it to log all output.
When necessary refer to the logs to locate information when output is verbose.
2 Logon to the FortiGate unit using a super_admin account.
3 Enter the following CLI commands.
4 Display all the possible IKE error types and the number of times they have occurred:
diag vpn ike errors
5 Check for existing debug sessions:
diag debug info
If a debug session is running, to halt it enter:
diag debug disable
6 Confirm your proposal settings:
diag vpn ike config list
7 If your proposal settings do not match what you expect, make a change to it and save
it to force an update in memory. If that fixes the problem, stop here.
8 List the current vpn filter:
diag vpn ike filter
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 81
http://docs.fortinet.com/