Problemas transferencia de datos VPN S2S Azure con Fortigate

Santiago Bueno 0

Buenos días,

Soy nuevo en la administración de servicios de azure, y me encuentro configurando una VPN S2S en mi portal Azure para crear un túnel con Fortigate. Realice la configuración viendo tutoriales y la documentación que da Microsoft y la VPN en el portal ya me da como estado CONECTADO, sin embargo, cuando voy a validar si hay transferencia de datos de entrada y salida no hay nada.

La idea de esta VPN es que yo pueda desde una VM que cree y asocie a la Vnet que tiene asociada el gateway vpn pueda alcanzar a una VM que esta administrada la red por fortigate, sin embargo, cuando intento entablar conexión ya sea por ping o por tracert, todos los paquetes se pierden, hay cero comunicación.

La configuración de la conexión de la VPN es la siguiente:

Usar la dirección IP privada de Azure: Deshabilitado

BGP: Deshabilitado

Directiva IPsec o IKE:

Fase 1 IKE

Cifrado:

AES256

Integridad/PRF

SHA256

Grupo DH:

DHGroup14

Fase 2 IKE (IPsec)

Cifrado IPsec:

AES256

Integridad de IPsec:

SHA256

Grupo PFS:

None

Duración de SA de IPsec en kilobytes: 0

Duración de SA de IPsec en segundos: 28800

Usar el selector de tráfico basado en directivas: Deshabilitar

Tiempo de espera de DPD en segundos: 45

Modo de conexión

Default

Protocolo IKE

IKEv2

Cuando uso el diagnostico de Azure me indica lo siguiente:

Microsoft Azure ha detectado un error de coincidencia en los selectores de tráfico de IPsec/IKE de la conexión VPN

Hemos identificado que la conexión VPN, 200.112.213.198 , está desconectada porque el dispositivo VPN local rechazó los selectores de tráfico propuestos por la puerta de enlace de VPN de Azure. Las puertas de enlace de VPN de Azure usan de forma predeterminada selectores de tráfico comodín (de cualquiera a cualquiera) en una configuración basada en rutas; o bien, puede habilitar la opción "UsePolicyBasedTrafficSelectors" en la conexión VPN, con la que las puertas de enlace de Azure usarán las combinaciones de los prefijos de red virtual y los prefijos de red locales como los selectores de tráfico.

La IP 200.112.213.198 es la Publica de fortigate, cuando en mi conexión de azure configuro la opción de Trafico basado en directivas, la VPN se desconecta. Hay alguna recomendación que pueda validar en azure? O este es un problema que puntual en el fortigate?

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2024-12-19T04:47:46.9+00:00

Translated using Bing Translate:

Good morning

I'm new to managing Azure services, and I'm setting up an S2S VPN on my Azure portal to create a tunnel with Fortigate. I made the configuration by watching tutorials and the documentation given by Microsoft and the VPN in the portal already gives me as a CONNECTED status, however, when I go to validate if there is data transfer in and out there is nothing.

The idea of this VPN is that I can from a VM that creates and associates with the Vnet that has the VPN gateway associated with it can reach a VM that is managed the network by fortigate, however, when I try to establish a connection either by ping or by tracert, all packets are lost, there is zero communication.

The VPN connection settings are as follows:

Use Azure Private IP Address: Disabled

BGP: Disabled

IPsec or IKE policy:

IKE Phase 1

Encryption:

AES256

Integrity/PRF

SHA256

DH Group:

DHGroup14

IKE Phase 2 (IPsec)

IPsec encryption:

AES256

IPsec Integrity:

SHA256

PFS Group:

None

IPsec SA lifetime in kilobytes: 0

IPsec SA Duration in Seconds: 28800

Use the policy-based traffic selector: Disable

DPD Timeout in Seconds: 45

Connection Mode

Default

IKE Protocol

IKEv2

When I use Azure diagnostics it tells me the following:

Microsoft Azure has detected a mismatch in the IPsec/IKE traffic selectors of the VPN connection

We have identified that the VPN connection, 200.112.213.198, is disconnected because the on-premises VPN appliance rejected the traffic selectors proposed by the Azure VPN gateway. Azure VPN gateways use wildcard (any-to-any) traffic selectors by default in a route-based configuration; Or, you can enable the "UsePolicyBasedTrafficSelectors" option on the VPN connection, where Azure gateways will use the combinations of the virtual network prefixes and the on-premises network prefixes as the traffic selectors.

IP 200.112.213.198 is the Public Fortigate one, when on my Azure connection I configure the Policy Based Traffic option, the VPN disconnects. Is there any recommendation that I can validate in azure? Or is this a problem that is specific in the fortigate?
KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2024-12-19T05:13:26.8666667+00:00
@Santiago Bueno ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

From your verbatim, I see the VPN Connection shows as "Connected" however you are not able to connect from VMs in Azure to servers/VMs behind your VPN Device.

You can find a list of Validated VPN devices here

It appears PolicyBased configuration is "Not Tested" for this 3rd party vendor.

From the error message, we see the OnPrem device is not accepting the Traffic selectors from Route Based VPN Gateway

Can you please check with your vendor if the device supports Route Based Tunnels to begin with?

If not, you can enable "UsePolicyBasedTrafficSelectors" to make the Gateway create a Policy Based Tunnel

More info on Connect a VPN gateway to multiple on-premises policy-based VPN devices

As next steps,

Did you check the OnPrem VPN Device logs?

What error does it give?

Does it say why the device is not able to establish the connection?

From Azure side, you can enable diagnostic logs for VPN Gateway

And check the GatewayDiagnosticLog, TunnelDiagnosticLog and IKEDiagnosticLog

You can use the logs to identify the exact timestamp to cross verify with OnPrem device logs

Cheers,

Kapil

Share via

Problemas transferencia de datos VPN S2S Azure con Fortigate

Your answer