IPsec VPN help

[Treuz]

Hello all, i need to create an IPsec VPN with a Public Authority that needs to reach an FTP server in my local network (192.168.0.0/24). They are expecting to reach my machine through a subnet defined by them that is 10.50.41.208/30, my ftp server is supposed to answer at address .209. My local subnet is 192.168.0.0/24 while the FTP machine is .20. What's the way to properly setup IPsec VPN and NAT/Routing to let my FTP server in local subnet be reachable through the addresses imposed by the client? I have a Fortigate 90D with firmware v5.6.3 build1547 (GA).

Thanks in advance.

[Toshi_Esumi]

I think they would route the /30 into the tunnel on their end. You must have gotten another subnet on their end for you to route into the tunnel from your end. Then you can use VIP with .209 address for FTP protocols to map to your FTP server's local IP 192.168-something, and use it with the inbound policy for the VPN.

[emnoc]

Also phase2 stc-subnets must be the  VIP  address and not the server.

e.g

config vpn ipsec phase2-interface

    edit MYVENDOR

           set src-subnet 10.50.41.209/32

   end

[Treuz]

toshiesumi wrote:

I think they would route the /30 into the tunnel on their end. You must have gotten another subnet on their end for you to route into the tunnel from your end. Then you can use VIP with .209 address for FTP protocols to map to your FTP server's local IP 192.168-something, and use it with the inbound policy for the VPN.

Correct: they have provided another /29 subnet for me to route into the tunnel.

emnoc wrote:

Also phase2 stc-subnets must be the  VIP  address and not the server.

e.g

config vpn ipsec phase2-interface

    edit MYVENDOR

           set src-subnet 10.50.41.209/32

   end

I'm not very familiar with console so i'm using the web interface.

So if my understanding is correct i need to setup the VPN tunnel between the two subnet with the /30 (or the single /32 address?) as source and the other subnet as destination. Then i create a VIP entry from .209 to my FTP server on local 192.168.x.x and I add this entry into an allow policy in the tunnel interface.