Site-to-Site with ASA and FortiGate

[scottsassin]

I have setup a site-to-site VPN between my ASA and the customers FortiGate. The tunnel comes up successfully, but we can't pass traffic. When I do a packet capture on my ASA, I see the traffic on the ingress port as normal, but on the egress port, the source address gets NAT'd. I have checked all the NAT statements, and there is a NAT Exempt statement from the ingress port to the egress port, and in the VPN configuration, 

[Karsten Iwen · Accepted solution]

Then your oder of the NAT statements in probably wrong. The dynamic NAT for the outgoing traffic has to be at the end (I put them always in section 3), while the Exemption has to be at the beginning of Section 1.