?
Solved

Fortigate 80C- firewall rules for PPTP VPN connections

Posted on 2010-01-02
6
Medium Priority
?
7,334 Views
Last Modified: 2012-05-08
Have just upgraded firewalls to a Fortigate 80C (previously Sonicwall)

Remote users are having trouble establishing VPN connections (Error 800)

The firewall offers only IPSec and SSL under the VPN options so I set the following under firewall rules:-

Source address - all
Destination address  - my server (interface internal)
Schedule  - always
Service PPTP
ACCEPT

What am I missing to allow these VPN connections?

0
Comment
Question by:Lisaa_G
  • 3
  • 3
6 Comments
 

Author Comment

by:Lisaa_G
ID: 26162381
Have added the following:-

Source address - all
Destination address  - my server (interface internal)
Schedule  - always
Service PPTP
ACCEPT

Users still getting error code 800 on connection -  Unable to establish a VPN connection.  User was fine earlier this morning on old firewall so I'm assuming this is not a problem at their end.
0
 

Author Comment

by:Lisaa_G
ID: 26167304
Sorry Service in previous posting should have read GRE
0
 
LVL 15

Expert Comment

by:bignewf
ID: 26167845

Did you check the following  (as the error indicates no connections at all)

In your firewall source address interface,  (go to Firewall>Address>Interface) make sure the internet facing internet is selected (This would be your vpn server endpoint)

This is what the manual states if the fortigate is configured as a vpn server

0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 15

Accepted Solution

by:
bignewf earned 2000 total points
ID: 26167893
Forgot to add, under source address, did you enter a range of ip addresses for the PPTP clients
and for destination address, this is normally the ip network behind the firewall that these clients need to access  (you would give this destination network a name i.e internal LAN) and then this name goes in the drop down box under destination address

for service should be "ANY" not PPTP  (since PPTP is a protocol, not a TCP/UDP service)
When you go to VPN>PPTP>PPTP range, you select "enable PPTP" and configure your starting and ending ip range of client addresses, as well as enabling PPTP. This is where the fortigate knows to establish a pptp tunnel

pp.15-20 in the manual will explain all this


0
 
LVL 15

Expert Comment

by:bignewf
ID: 26167917
Also, GRE is a protocol, not a service as explained above. (Just trying to clarify the terms here)

I just set up one of these the other day and it successfully connects using the above scenario

thanks
0
 

Author Comment

by:Lisaa_G
ID: 26174855
Thank you - have switched back to old firewall to keep people productive today - I'll make the changes and test later tonight - appreciate the feedback will let you know how it goes
0

Featured Post

What Security Threats Are We Predicting for 2018?

Cryptocurrency, IoT botnets, MFA, and more! Hackers are already planning their next big attacks for 2018. Learn what you might face, and how to defend against it with our 2018 security predictions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Secure VPN Connection terminated locally by the Client.  Reason 442: Failed to enable Virtual Adapter. If you receive this error on Windows 8 or Windows 8.1 while trying to connect with the Cisco VPN Client then the solution is a simple registry f…
If you’re involved with your company’s wide area network (WAN), you’ve probably heard about SD-WANs. They’re the “boy wonder” of networking, ostensibly allowing companies to replace expensive MPLS lines with low-cost Internet access. But, are they …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Suggested Courses
Course of the Month13 days, 12 hours left to enroll

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question