Skip to main content
jpbody
jpbody
New Member
August 9, 2019
Solved

help with routing over ipsec vpn

  • August 9, 2019
  • 1 reply
  • 4383 views

I am hoping somebody can help me out with this.  I have a client with a fortigate 60D I have it setup with remote access ipsec vpn's using the forticlient software to for clients to connect to router.  This is at a law enforcement site so there is another router on this network that goes out to the Florida Department of Law Enforcement (FDLE).  I have the ipsec vpn connected and can see the internal network and I have route static route statements in the fortigate to route internal network to the FDLE router and that works great I just need to get the ipsec vpn clients to send certain subnet requests over the vpn besides just the internal network subnets.  So the question is how do I get the clients to send other subnets over the vpn connection along with the internal network requests?

 

Thank you

Jason 

    Best answer by tputterman

    You need to add these other subnets to your local subnets for the VPN tunnel config.

    This would be under the Accessible networks section of your IPSec Config.

    This should be an address group object, Default is usually tunnelname_Local_Subnet. Create new address object and add it to the local_subnet object, or whatever you have it called.

     

    From there you would need to have firewall policies in place to allow that traffic in on the tunnel and out to wherever it needs to route to. Routing policies would also be needed to route to that other router(I assume this is already in place) put the correct interface.

     

    Depending on what you are doing with Nat, you also may need to have routing policies on the other router to route the traffic back to your Fortigate. The VPN traffic is going to be a different IP range. Personally I don't like to nat anything internal, but you would need to have control of the other router to ensure the traffic is routed back to the fortigate for the VPN tunnel.

    Thanks

    Greg

    1 reply

    tputterman
    tputtermanAnswer
    New Member
    August 9, 2019

    You need to add these other subnets to your local subnets for the VPN tunnel config.

    This would be under the Accessible networks section of your IPSec Config.

    This should be an address group object, Default is usually tunnelname_Local_Subnet. Create new address object and add it to the local_subnet object, or whatever you have it called.

     

    From there you would need to have firewall policies in place to allow that traffic in on the tunnel and out to wherever it needs to route to. Routing policies would also be needed to route to that other router(I assume this is already in place) put the correct interface.

     

    Depending on what you are doing with Nat, you also may need to have routing policies on the other router to route the traffic back to your Fortigate. The VPN traffic is going to be a different IP range. Personally I don't like to nat anything internal, but you would need to have control of the other router to ensure the traffic is routed back to the fortigate for the VPN tunnel.

    Thanks

    Greg

    jpbody
    jpbodyAuthor
    New Member
    August 10, 2019

    Thank you very much.  With what you told me I had the networks added to the accessible networks already but what I did not do was go in the firewall rule for the remote vpn connection and add the other network in there for the destination networks so it is working great now.  So again thank you very much for the help

    Terms & ConditionsCookie settingsAccessibility statement