Hi All, I deployed FortigateVM at Azure Portal with BYOD, and installed Windows 10 VM too for testing to outsite. I configure IPSec VPN between FortigateVM at azure <> to Fortigate OnPremise at my Office. VPN tunnels are established. Win10 VM reachable to Window Apliance on my office, but if i try ping from Windows appliance to Win10 VM, that not reachable / RTO. -Win10 VM reachable to internet. -NIC at Win10 VM Azure already allowed all for NSG -routing table already configured Much appreciated for your help. Thanks. Jasa

@Jasa Atum , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I see you are using a 3rd party NVA in Azure to set up a Site to Site VPN and not Azure VPN Gateway. I believe you are following the configuration from Connecting a local FortiGate to an Azure FortiGate via site-to-site VPN . Please note that community members in Q&A Forum would have expertise over Azure Products. However, the same cannot be said for 3rd party services (as VMs are IaaS Offerings). With that said, AzureVM to OnPrem servers working indicates that the routing is properly configured. OnPrem servers to AzureVM not working indicates either OnPrem servers are not properly routed to the "Fortigate OnPremise" or your NVA (FortigateVM) is not forwarding the traffic to Azure VMs. As next steps, I would suggest you to check with the 3rd party's support or community forum to get more details on the configuration or logs which you could gather within the NVA. Cheers, Kapil

end point at azure can not reach from outside

Accepted answer

KapilAnanth-MSFT 48,486 Reputation points Microsoft Employee

2024-05-22T09:18:21.62+00:00
@Jasa Atum ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I see you are using a 3rd party NVA in Azure to set up a Site to Site VPN and not Azure VPN Gateway.

I believe you are following the configuration from Connecting a local FortiGate to an Azure FortiGate via site-to-site VPN.

Please note that community members in Q&A Forum would have expertise over Azure Products.

However, the same cannot be said for 3rd party services (as VMs are IaaS Offerings).

With that said,

AzureVM to OnPrem servers working indicates that the routing is properly configured.

OnPrem servers to AzureVM not working indicates either

OnPrem servers are not properly routed to the "Fortigate OnPremise"

or your NVA (FortigateVM) is not forwarding the traffic to Azure VMs.

As next steps,

I would suggest you to check with the 3rd party's support or community forum to get more details on the configuration or logs which you could gather within the NVA.

Cheers,

Kapil
Please sign in to rate this answer.
Jasa Atum 20 Reputation points

2024-05-22T09:40:47.4766667+00:00

@KapilAnanth-MSFT

Thanks for your respond mate,

Yap, configuring the VPN IPSec is proper as guide.

Specifically, the VPN Tunnel already establish. I just wonder why if ping from my office to Windows10-VM at the azure is not reachable. if i see at the fortigate onprem looks like accepted.:

172.18.9.23 -> mylaptop at office

10.10.102.5 -> win10-vm at azure.

Firewall already allowed for ICMP at win10-vm. what else i need to check at Win10-VM.

KapilAnanth-MSFT 48,486 Reputation points Microsoft Employee

2024-05-22T10:59:08.88+00:00

@Jasa Atum ,

May I know if you verified that the packet (from OnPREM to Azure VM) reached the NVA at Azure first?

Do you have any logs or packet capture indicating that the NVA received the traffic

And it did inturn forward it to the AzureVM?

If not, I would suggest you to troubleshoot that first.

Cheers,

Kapil

Jasa Atum 20 Reputation points

2024-05-22T16:27:48.3966667+00:00

Hi @KapilAnanth-MSFT

Here is the topology:

Azure:

Win10-VM [10.10.102.5] -> [internal:10.10.102.11] FortVM [external:10.10.101.4]

tunnel to FGOnPrem is establish:

vm-fortigate-prod # diagnose vpn ike gateway list

vd: root/0

name: AZR-STR

version: 1

interface: port1 3

addr: 10.10.101.4:4500 -> 110.145.224.210:4500

tun_id: 110.145.224.210/::110.145.224.210

remote_location: 0.0.0.0

network-id: 0

virtual-interface-addr: 10.200.200.254 -> 0.0.0.0

created: 2159s ago

peer-id: 110.145.224.210

peer-id-auth: no

nat: me

IKE SA: created 2/2 established 2/2 time 100/130/160 ms

IPsec SA: created 1/1 established 1/1 time 40/40/40 ms

id/spi: 4 b7d247d280f80e0d/cc7060723fdeefc6

direction: responder

status: established 2156-2156s ago = 100ms

proposal: aes256-sha256

key: 824318e8202fab91-2af6b3d29cdd8e09-fa6efa48076a8609-a3961344fda142f8

lifetime/rekey: 3600/1173

DPD sent/recv: 00000000/00000000

peer-id: 110.145.224.210

id/spi: 2 e02dc5d1c95e9a9e/f7644ceaaa535f08

direction: initiator

status: established 2159-2159s ago = 160ms

proposal: aes256-sha256

key: 4c7165e01fde3608-ae0dedaa1323b8fb-ed9ac4c980129ad8-8d04c587b7ffa68c

lifetime/rekey: 3600/1140

DPD sent/recv: 00000000/00000000

peer-id: 110.145.224.210

vm-fortigate-prod #

Ethernet adapter Ethernet:

Physical Address. . . . . . . . . : 60-45-BD-3F-7F-13

IPv4 Address. . . . . . . . . . . : 10.10.102.5(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 10.10.102.1

DHCP Server . . . . . . . . . . . : 168.63.129.16

DNS Servers . . . . . . . . . . . : 168.63.129.16

C:\Users\jasaatum>

C:\Users\jasaatum>ping 172.18.9.23

Pinging 172.18.9.23 with 32 bytes of data:

Reply from 172.18.9.23: bytes=32 time=41ms TTL=126

Reply from 172.18.9.23: bytes=32 time=41ms TTL=126

Reply from 172.18.9.23: bytes=32 time=40ms TTL=126

Reply from 172.18.9.23: bytes=32 time=41ms TTL=126

vm-fortigate-prod # diagnose sniffer packet any "host 10.10.102.5 and icmp" 4

Using Original Sniffing Mode

interfaces=[any]

filters=[host 10.10.102.5 and icmp]

0.483012 port2 in 10.10.102.5 -> 172.18.9.23: icmp: echo request

0.483033 AZR-STR out 10.10.102.5 -> 172.18.9.23: icmp: echo request

0.522832 AZR-STR in 172.18.9.23 -> 10.10.102.5: icmp: echo reply

0.522855 port2 out 172.18.9.23 -> 10.10.102.5: icmp: echo reply

the issue is, when im ping from my laptop at headquarter office to win10-vm at the azure is not reachable and there is no traffic flow.

KapilAnanth-MSFT 48,486 Reputation points Microsoft Employee

2024-05-22T16:38:10.59+00:00

@Jasa Atum ,

I am afraid I cannot validate the configuration part of the NVA.

However, when you say "there is no traffic flow" - I take it that you are not seeing packets from OnPREM arriving at the NVA.

In that case, you should validate the routing from your OnPREM to the NVA via S2S

And check with the NVA vendor to verify if the configurations are correct.

Unfortunately, as you are not using a VPN Gateway - we can neither check the logs nor validate the S2S Tunnel's configuration.

Thanks,

Kapil

Jasa Atum 20 Reputation points

2024-05-22T16:54:58.86+00:00

Hi @KapilAnanth-MSFT

Problem Solved.

need to enable ip forwading at all NIC card:

Now im enable to ping to segment at onPrem

Log ICMP on FGT:

Thank mate.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

end point at azure can not reach from outside

0 additional answers

Your answer