Can't establish a IPSEC tunnel btw Sophos XG and Fortigate

please show this unfolded:

hello, we have this


We have also tried to make a new IKEV2 profile using only these numbers

but its not working also.

looks OK.

have you checked the text logs both machines? do they even reach each other?

on XG side you find IPSec logs here: /log/strongswan.log

what do you find there when you stop and start the tunnel on XG?

Hi Luis Antonio Usquiano

192.168.0.2 is private network did you allowed 500 port on your upstream router ?

check tcpdump 

Go to SSH option 4

console>tc 'port 500

Regards

hello
i have created a dmz on my routing targeting my sophos WAN interface

so all the ports are opened

share tcp dump 

Hi @Luis Antonio Usquiano,

On XG, check /log/charon.log (from CLI), if you see only below log if the IPsec tunnel is set to Initiator, most likely some configs need to be checked on Fortigate; even with single config missing on Fortigate, it will not respond to the packet from XG.

sending packet: from <ip address of XG>[500] to <ip address of Fortigate>[500]

On Fortigate, Your policy config(these are the packet forwarding rules) should look like below:

Policy & Objects: IPv4 policy: 

Incoming interface: LAN port of Fortigate where 192.168.100.0/24 is configured.

Outgoing interface: WAN port of Fortigate talking to XG

Action: this should have IPSec option, once IPsec is chosen, you will be prompted to enter the tunnel name - chose the tunnel name; also turn ON 'Allow traffic to be initiated from remote side' option (this will serve as packet filtering policy from WAN to LAN side on Fortigate)

To have IPsec option in the Action, Enable this on Fortigate:  From System : Feature Select : Additional Features : Policy-based IPsec VPN