Skip to main content
Gurrav
Gurrav
New Member
August 18, 2025
Question

fortinet routing issue on the dialup vpn hub version 7.4

  • August 18, 2025
  • 1 reply
  • 651 views

Hi,

 

We have SDWAN VPN Dialup with fortios 7.4 

we used BGP for routing

 

HUB 10.220.1.1/24                                SPOKEN1 10.220.1.2/24

                                                                SPOKEN2 10.220.1.3/24

 

We have ping from spokens to hub  but no ping from hub to spoken.

 

we check this links and we see that same problem,  then we tray the solution but it does no worked.

 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hub/ta-p/328641

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Potential-routing-issue-on-the-Dialup-VPN-hub/ta-p/307683

 

please help me

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
August 18, 2025

I wouldn't use one phase1-interface when I need to connect two site2site dialup VPNs at a HUB, but would use "peer ID/local ID" setting to separate them and have two phase1-interfaces on the HUB side then BGP to decide which one to route to.

But if you have to have only one phase1-interface for both, try "set net-device enable" on the HUB's phase1-interface config. I because you're config has is disabled (default setting).

Toshi 

    Gurrav
    GurravAuthor
    New Member
    August 19, 2025
    Hi Toshi, The set net-device enable command didn't work, and I even lost ping from the spoken devices to the hub. I rechecked the link community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hub/ta-p/328641, scenario 1, and issued the command on the hub and spoken devices. Then I published the/32 IP addresses over BGP, and it started working.  Thank you very much for responding.
      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      August 19, 2025

      I assumed you already had a /32 static route at least on the spoke side:
      config sys int
         edit [phase1_interface_name]
             set ip x.x.x.x 255.255.255.255 
             set remote-ip y.y.y.y 255.255.255.255 <- HUB side IP
         next
      end
      since you said spokes can ping HUB.
      But on the HUB side, since you have one phase1-interface for all spokes, you can't statically configure the "remote-ip" per spoke. Then need to rely on the "set exchange-interface-ip enable" in the KB:
      https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hub/ta-p/328641
      to pull the remote IP/route when tunnel comes up, which you smartly found out yourself.

      That's another reason we always separate phase1-interfaces even for dialup IPsec if site2site, which makes routing simpler and intuitive/predictable.

      Toshi

      Terms & ConditionsAccessibility statement