Skip to main content
dholton912
dholton912
New Member
January 7, 2024
Solved

Allow One IP to Remotely Browse through Site-to-Site

  • January 7, 2024
  • 3 replies
  • 14878 views

Hey everyone!

 

I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719 but am unable to get what I need to work. Any help with this would be greatly appreciated!

Best answer by hbac

@dholton912, 

 

I believe your default route is pointing to wan2 which is why it doesn't match the policy route. You will need another static route and point it to the IPSec tunnel. You can create a static route for 8.8.8.8 for testing and point it to the IPSec tunnel. After that, run the debug flow again. 

 

Regards, 

3 replies

AEK
SuperUser
AEK
SuperUser
January 7, 2024

Hello

Did you try with policy route?

AEK
    mpeddalla
    Staff
    mpeddalla
    Staff
    January 7, 2024

    Hello  @dholton912 ,

     

    Thank you for contacting the Fortinet Forum portal.

    -You can create a policy route on firewall B with source 10.0.0.50 to destination 0.0.0.0/0.0.0.0 interface should be site to site vpn tunnel.

    -On the remote site create a firewall policy or make sure the traffic passes via the wan interface from that source.

    article for policy route 

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-p/189996

     

     

     

    Best regards,

    Manasa.

     

    If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

      dholton912
      dholton912Author
      New Member
      January 7, 2024

      So when creating the policy route, do I create it on FW B or A? 

      AEK
      SuperUser
      AEK
      SuperUser
      January 8, 2024

      You create it on firewall A with source 10.0.0.50.

      Try use policy routes for exceptions only.

      If you read the tech tip provided by @mpeddalla you will take real advantage of the policy routes.

      AEK
        Terms & ConditionsAccessibility statement