6.0.6 - Route a IPSEC subnet to another IPSEC

Question

Hello Guys,i have a strange question:i have two IPSEC tunnels as below:branch 01 ----- HQ ------ azureip1 -> iphq    iphq->ip1                   iphq+ip1->ipaz       ipaz->iphq+ip1we can't have any more IPSEC tunnel on brach01 so i'm trying to route the subnet ipaz presented by the tunnel between hq and azure to branch01 and vice versa.I think i'm missing something in between also i can't nat because we have video traffic that don't like nats. any ideas? THX a lot!

kcheng · Accepted Answer

Hi,

You should be able to achieve the respective with the following:

1. In HQ, ensure that branch local subnet is included as the local subnet in the Phase2 between the VPN tunnel of HQ - Azure, and the subnet of Azure is included as the local subnet for Phase2 between VPN tunnel of HQ and Branch01

2. Ensure that there is a policy in HQ that allows traffic between IPSec_Branch01 - IPSec_Azure and reverse policy

3. If HQ is able to connect to Branch01 and Azure without any issue, I believe the static route is already in place

4. In Branch01, make sure that remote subnet for Azure is configured in Phase2 selector for the IPSec tunnel between Branch01 and HQ

5. Ensure that Azure remote subnet is included in the firewall policy for local port to IPSec_HQ in Branch01

6. Ensure that Azure firewall is configured to permit traffic as well

If you already have all the above in place and still not able to reach to Azure site from Branch01, I would suggest you run the following commands on all the firewall (if they are all FortiGate) to check what could be the root cause:

diag deb flow filter saddr <source_IP_from_branch>

diag deb flow filter daddr <destination_IP_on_Azure>

diag deb flow sh function-name en

diag deb flow sh iprope en

diag deb flow trace start 20

diag deb en

Then, test the connection from Branch01 user and check how is the traffic being processed.

ede_pfau · Answer

It doesn't suffice to just have 2 routes in place. Each subnet needs to know how to reach the other 2 subnets, and that calls for 2 routes.

in branch:

route to HQ

route to AZ

in HQ:

route to branch

route to AZ

in AZ:

route to HQ

route to branch

As the FGT is not only a router but a firewall, you need to allow those subnets in policies. Just use 2 address objects in the ingress and egress policies, on each FGT.

Of course, everything else in Kayzie's answer is 100% correct and helpful. 'diag debug flow' will show exactly what is going on, if you think that routes and policies are all in place and it still doesn't work.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded