Okat bravo if I can make some recommendation
On the remote firewall your phase2 needs to have this added on FG80
edit "VPN-HQ-BRANCH"2"
set phase1name "VPN-HQ-BRANCH"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
set src-addr-type name
set dst-addr-type name
set src-name "192.168.254.0/24"set dst-name "192.168.257.0/24"next
end
You will also needs policyes on both firewall to allow the 1.1.1.0s address
e.g
config firewall address
edit 10.1.1.0-24
set subnet 10.1.1.0/24
end
config firewall policy
edit 0
set name "allow_vpn_interfaces"
set srcintf "VPN-BRANCH"
set dstintf "VPN-BRANCH"
set srcaddr "10.1.1.0-24"
set dstaddr "10.1.1.0-24"
set action accept
set schedule "always"
set service "PING"
next
end
Make sure the policy is high up in the seq#. I believe if you fix the phase2-config, apply a policy 10.1.1.x can ping the lan behind the remote fgt over the ipsec-interface.
For future reference when providing the cfg just do a "show" and not a "get" . The output is much easier to read imho
e.g demostration of get and show with a firewall policy
brooklyn-south (13) #
getpolicyid : 13
status : enable
name : QUIC-BROWSERS
uuid : d07a8548-0360-51eb-f755-ab46572a1f7f
srcintf : "lan"
dstintf : "wan1" "upg-zone-wan2"
srcaddr : "LAN"
dstaddr : "all"
srcaddr6 :
dstaddr6 :
internet-service : disable
internet-service-src: disable
reputation-minimum : 0
src-vendor-mac :
rtp-nat : disable
action : accept
schedule : always
schedule-timeout : disable
service : "QUIC"
tos-mask : 0x00
anti-replay : enable
utm-status : disable
inspection-mode : flow
profile-protocol-options: default
ssl-ssh-profile : no-inspection
logtraffic : utm
logtraffic-start : disable
auto-asic-offload : enable
np-acceleration : enable
permit-any-host : disable
permit-stun-host : disable
fixedport : disable
ippool : disable
session-ttl : 0
vlan-cos-fwd : 255
vlan-cos-rev : 255
wccp : disable
groups :
users :
fsso-groups :
disclaimer : disable
email-collect : disable
natip : 0.0.0.0 0.0.0.0
diffserv-forward : disable
diffserv-reverse : disable
tcp-mss-sender : 0
tcp-mss-receiver : 0
comments :
block-notification : disable
custom-log-fields :
replacemsg-override-group:
srcaddr-negate : disable
dstaddr-negate : disable
service-negate : disable
timeout-send-rst : disable
captive-portal-exempt: disable
dsri : disable
radius-mac-auth-bypass: disable
delay-tcp-npu-session: disable
vlan-filter :
traffic-shaper :
traffic-shaper-reverse:
per-ip-shaper :
nat : enable
brooklyn-south (13) #
showconfig firewall policy
edit 13
set name "QUIC-BROWSERS"
set uuid d07a8548-0360-51eb-f755-ab46572a1f7f
set srcintf "lan"
set dstintf "wan1" "upg-zone-wan2"
set srcaddr "LAN"
set dstaddr "all"
set action accept
set schedule "always"
set service "QUIC"
set nat enable
next
end
The latter is much easier to read and to follow , imho for just reviewing the cfg.
Ken Felix
post edited by emnoc - 2020/11/25 14:27:38