Skip to main content
Wayne11
Wayne11
Explorer
September 4, 2017
Question

5.6.2 Policy routing for Fortiguard services

  • September 4, 2017
  • 1 reply
  • 8705 views

Hi

 

We use a new FWF60E with 5.6.2 in one of our branches and except the public IP or the HQ Forti (to establish the VPN) we route everything directly into the VPN tunnel to our HQ. That's working fine since years and also now with the new FWF60E, but we can't reach the Fortiguard servers that way, even all the ports to the tunnel are open.

So we would like to create a Policy Route for the FWF60E for all the local traffic going directly to WAN1 and not passing the VPN, but we fail as well. I've read it's not possible to create a Policy Route for local traffic, so therefore my question, how can we solve this problem we have now with 5.6.2 and the Forti can somehow establish the Fortiguard services? Is it true that the Forti needs a direct connection to the WAN for it? Shouldn't it also work through an existing VPN tunnel to connect the Fortiguard services?

 

Appreciate any suggestion.

Thx

Wayne

    1 reply

    oheigl
    oheigl
    New Member
    September 4, 2017

    If you want to go directly to the WAN:

    Create another default route with a lower priority (higher priority value than the existing route so it's not taking precedence) and define the public IP in the source fields of the services like it's explained here: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-system-administration-54/Advanced/IP%20addresses%20for%20self-originated%20traffic.htm

     

    If you want to go through the VPN:

    Define the source IP of the services to your local private IP address of the FortiGate, then it's routed through the VPN. In the HQ you need to allow the traffic from the branch FGT and forward it with source NAT to the WAN.

     

    For FortiGuard features an example:

    config system fortiguard

    set source-ip x.x.x.x
    end

    Wayne11
    Wayne11Author
    Explorer
    September 4, 2017

    oheigl wrote:

    If you want to go directly to the WAN:

    Create another default route with a lower priority (higher priority value than the existing route so it's not taking precedence) and define the public IP in the source fields of the services like it's explained here: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-system-administration-54/Advanced/IP%20addresses%20for%20self-originated%20traffic.htm

     

    It's not working that way, we have tried with the internal IP or public IP as "source IP" in the fortiguard config, we were never able to reach the Fortiguard services on port 53 nor on 8888.

     

    XXXX-XXXX (fortiguard) # get
    port : 53
    load-balance-servers: 1
    auto-join-forticloud: enable
    antispam-force-off : disable
    antispam-cache : enable
    antispam-cache-ttl : 1800
    antispam-cache-mpercent: 2
    antispam-license : Contract
    antispam-expiration : Mon Aug 31 2020

    antispam-timeout : 7
    webfilter-force-off : disable
    webfilter-cache : enable
    webfilter-cache-ttl : 3600
    webfilter-license : Contract
    webfilter-expiration: Mon Aug 31 2020

    webfilter-timeout : 15
    sdns-server-ip : "208.91.112.220"
    sdns-server-port : 53
    source-ip : PUBLIC_IP
    source-ip6 : ::
    ddns-server-ip : 0.0.0.0
    ddns-server-port : 443

     

    Also with an "Internet Service" route with the "Fortinet-FortiGuard" or "Fortinet-Web" we are unable to to establish a connection. The only way we are able to connect to the FortiGuard services is when we move the default route pointing to the WAN interface instead into the tunnel interface. 

     

    We have to analyze the option through the VPN more in detail, but I'm almost 100% sure we have configured it that way and also no success. But could be that it will work now after we had established the initial connection to the support portal and retrieved the license and registration data. We will try as soon as possible.

     

    Thax

    kallbrandt
    kallbrandt
    New Member
    September 4, 2017

    Hello,

    Have you tried to use a loopback interface?

    Add a firewall policy that allows it out via wan, with NAT enabled.

    Set loopback as source-IP for the FortiGuard services, add a default route to wan with same distance (10?) and slightly higher priority value then the def route via IPsec.

    Add three policy routes from the loopback IP to the three RFC 1918 address spaces, and set them to STOP POLICY ROUTING. (this is IF the networks on the other side of the IPsec-tunnel are RFC 1918, obviously).

    Add the last rule from the loopback IP to 0.0.0.0, point it to wan, don't add an IP, 0.0.0.0 is fine.

     

    NO guarantee it will work with a loopback, good luck. :)

    Terms & ConditionsAccessibility statement