Technical Tip: Static route for IPsec VPN shows gateway configured

Description

This article describes how FortiGate is selecting a gateway for static routes via an IPsec VPN tunnel.

Scope

FortiGate.

Solution

In the earlier version, the static route when configured via IPsec VPN tunnel showed up as a connected route in the output of '# get router info routing-table details'.

C 192.168.8.0/24 is directly connected, VPN-1

From FortiOS 7.0, this behavior has changed and the static route configured via the IPsec VPN tunnel would have the gateway as the tunnel ID of the IPsec VPN tunnel.

VPN phase-1 configuration.

config vpn ipsec phase1-interface
    edit "VPN-1"
        set interface "port1"
        set peertype any
        set net-device disable
        set proposal aes128-sha256
        set remote-gw 10.10.16.156
        set psksecret ENC xx
    next
end

Static route configurator.

config router static
    edit 2
        set dst 192.168.8.0 255.255.255.0
        set device "VPN-1"
    next
end

To confirm the gateway selected for the static route, run the following command.

diagnose vpn tunnel list
name=VPN-1 -NEW ver=1 serial=c
tun_id=10.10.16.156 dst_mtu=156@ dpd-link=on remote_location= weight=1
bound_if=39 lgwy=static/1 tun=intf/@ mode=auto/1 encap=none/52@ options[62@B]=npu frag-rfc run_state=@ accept_traffic=1 overlay_id=0

The above command would show tun_id that is selected as the gateway for the IPsec VPN routes configured.

get router info routing-table details | grep VPN-1
S 192.168.8.0/24 [10/0] via 10.16.16.156, VPN-1

Note:

In case the Remote Gateway IP has been changed, 'tun_id' will remain the same as before. But the tunnel will work as earlier.