Stand alone VPN device

[robink]

I have a 30E and trying to setup a site to site VPN using the device as a stand alone VPN device behind a firewall. I have disabled the wan int and created a default route that points to actual site firewall. The Foritgate sees the internet, downloaded and installed an updated firmware. I connect communicate with the Fortigate through the firewall. With all that being said I cannot get the VPN to come online. The VPN is configured use the lan interface and in troubleshooting the issue I did some packet monitoring on the site firewall (firewall this device's traffic passes through) and I don't see any packets going to the IP address of the remote VPN gateway. I can see other traffic but not a single packet gets picked up for the remote VPN gateway. I use the "Bring UP" option on the VPN and still nothing. Really can't understand how this can be. I've done this exact same type of setup on a SonicWall a half dozen times without any issue. 

Only other thing I should note is that I did not register or activate any online features. Could that be preventing all VPN traffic?

[Toshi_Esumi]

So you're trying the 30E "on a stick" topology, right? But VPN itself should come up via its internal interface then go over the GW FW if it's set up properly.

If you don't see anything obviously wrong in the vpn config, you need to start debugging started with just pinging the peer GW IP to make sure it's reachable, then IKE debugging as described in below cookbook.

https://cookbook.fortinet.com/ipsec-vpn-troubleshooting/

[robink]

Thanks for the follow-up. I called support and the issue is resolved. It was my mistake in that I didn't setup the VPN routing or access rules yet as I got hung up on the fact that FortiGate would not even try to establish the tunnel (no packets passing through the perimeter firewall). On the SonicWall (which I used to) you don't need to worry about those things until you want to actually communicate "through" the VPN tunnel. Live and learn... :)

[lobstercreed]

robink wrote:

Only other thing I should note is that I did not register or activate any online features. Could that be preventing all VPN traffic? 

No, that would not have any effect.  I agree with Toshi...some methodical debugging is in order.  I've done a config almost identical to yours several years ago and encountered some routing challenges that packet capturing helped solve. 

I think my issue at the time was that I put the FortiGate on the same subnet as the clients that were supposed to get out across the VPN.  Once I split the subnet so that the FG and its default gateway was different than the clients, things worked right.