Technical Tip: Configure policy routes for route-based (interface-based) IPsec VPNs

Description

This article describes how to configure a policy route so that only certain traffic will traverse through a route-based IPsec VPN tunnel.

Scope

FortiGate.

Solution

Although a static route that has a destination interface of a VPN tunnel does not require a gateway IP address, a policy route does. The solution is to configure an 'IP' and 'Remote IP' on the virtual tunnel interface and use the 'Remote IP' as the gateway IP address in the policy routes. Specifying the 'Remote IP' as the tunnel interface will not require any static route through the tunnel to match the gateway IP address.

Note: The IP is not required to be configured on the remote gateway tunnel interface. When the Policy route is configured with the tunnel interface, it does not check whether the gateway IP is reachable, unlike in the case of the physical interface.

1. Define the IP and the remote IP to be used for the tunnel interface. The best practice is to choose IP addresses in a subnet that is not currently used on the FortiGate.

From the CLI:

config system interface 
    edit "VPN01" 
        set vdom "root" 
        set ip 10.1.1.1 255.255.255.255 
        set type tunnel 
        set remote-ip 10.1.1.2 255.255.255.252 
        set interface "port1" 
    next 
end

2. Use the 'Remote IP' as the gateway IP address in the policy route.

In cases with BGP/OSPF routes via the dial-up tunnel, the Gateway Address would be the neighbor IP. This can be determined by running the following:

FGT_A #get router info routing-table details 172.16.201.5
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default
Routing table for VRF=0
B       172.16.201.0/24 [20/0] via 10.10.102.87, wan2, 02:09:50

In this case, the Gateway Address is 10.10.102.87.

From the CLI:
 

config router policy
    edit 1
        set input-device "port3”
        set src "VPN01_local"
        set dst "VPN01_remote"
        set gateway 10.1.1.2
        set output-device "VPN01"
    next
end

Note:
As of v6.2, matching policy routing can be checked from the debug flow.

2019-12-27 16:03:02 id=20085 trace_id=148 func=print_pkt_detail line=5460 msg="vd-root:0 received a packet(proto=1, 172.16.1.1:1->192.168.1.1:2048) from port3. type=8, code=0, id=1, seq=87."
2019-12-27 16:03:02 id=20085 trace_id=148 func=init_ip_session_common line=5625 msg="allocate a new session-00975287"
2019-12-27 16:03:02 id=20085 trace_id=148 func=vf_ip_route_input_common line=2581 msg="Match policy routing id=1: to 192.168.1.1 via ifindex-50"
2019-12-27 16:03:02 id=20085 trace_id=148 func=vf_ip_route_input_common line=2596 msg="find a route: flag=04000000 gw-10.1.1.2 via VPN01"
2019-12-27 16:03:02 id=20085 trace_id=148 func=fw_forward_handler line=783 msg="Allowed by Policy-1:"
2019-12-27 16:03:02 id=20085 trace_id=148 func=ipsecdev_hard_start_xmit line=777 msg="enter IPsec interface-VPN01"
2019-12-27 16:03:03 id=20085 trace_id=148 func=esp_output4 line=904 msg="IPsec encrypt/auth"
2019-12-27 16:03:03 id=20085 trace_id=148 func=ipsec_output_finish line=622 msg="send to 10.104.7.80 via intf-wan1"