New Member

Question

Applying Policies to static routes

Forum|Forum|6 years ago
May 14, 2020
4 replies
5199 views

I have a 192.168.1.0 network with the Fortigate as the default gateway (192.168.1.1). I have a vendor supplied VPN firewall that gives us access to a remote network (192.168.2.0). The vendor firewall uses a IP on my internal network (192.168.1.2). I built a static route entry on my Foritgate (route 192.168.2.0/255.255.255.0 to 192.168.1.2) and I can ping devices on the 192.168.2.0 network without any issue. However, I wanted to apply an IPV4 policy to this traffic, so that I can filter it. However, it just passes all traffic and I can't seem to get an IP policy to apply to it. Since the Fortigate is acting like a router for this traffic can I not apply policies to it?

ede_pfau

SuperUser

No, you can't. The FGT is a router (in your setup), and local traffic between hosts on the same subnet is not crossing the FGT.

Alternatively, connect the VPN router to a free port on the FGT (say, DMZ), create a small "transit subnet" like 10.11.12.0/30, assign 10.11.12.1 to the FGT DMZ port and .2 to the VPN router. Then you literally have to create a policy from DMZ to WAN to allow traffic out (ESP or udp/500, udp/4500) to establish the VPN, and 2 policies to/from DMZ/LAN. These control the unencrypted traffic, as you wish.

The default route on the VPN router needs to point to 10.11.12.1. Either you add a second route to your LAN, or NAT the traffic.

emnoc

New Member

Your best bet is what Ede said or build a secondary address on the interface like a /31 or /30 and put the vendor firewall in place on that secondary if your limited to the total # of ports on the FGT. I believe you could maybe write a policy with src/dst interface being the same port that has the secondary-IP and apply a policy for filtering

i.e /* example assuming the interface is named LAN

FGT

/* LAN port in this example

192.168.1.99/24

192.0.2.1/31

3rdPartyFW

192.0.2.2/31

config sys interface

edit LAN

set secondary-IP enable

config secondaryip edit 1

set ip 192.0.2.1/31 next end

end

config router static

edit 88888

set dst 192.168.2.0/24

set gateway 192.0.2.2 <----the address on 3rdparty vendor gear

set dev lan

end

config firewall address

edit "MYLOCAL-LAN"

set subnet 192.168.1.0/24 next edit "REMOTE_LAN" set subnet 192.168.2.0/24 next

end

config firewall policy edit 0 set srcintf lan set dstintf lan set srcaddr MYLOCAL_LAN set dstaddr REMOTE_LAN set action accept set schedule "always" set service "ALL" next

Give that a try and update us.

Ken Felix

skoneAuthor

New Member

I can confirm a secondary IP address on the same interface will let you apply policies.

Sign up

Login with SSO

Login to the community

Login with SSO