How to route ougoing FG traffic through ipsec vpn

Question

Hello, I am facing problem with simple site to site ipsec VPN between tho Fortigates (FG-60F, 7.4.3).

Communication between both subnets is working fine, but I need the remote fortigate to be able to reach local lan. From what I read it is normal the FG does not know it should communicate through the ipsec tunnel, even when it has specified static route. On most parts I have solved this by using "set source-ip" and putting in the FG LAN IP, but for instance external fabric connectors - there does not seems to be way to specify source-ip for external fabric connector, it is not accepting the command.

Main site:
LAN 10.231.32.0/24
FG LAN IP 10.231.32.1
Static route to 10.231.33.0/24 through ipsec

Remote site:
LAN 10.231.33.0/24
FG LAN IP 10.231.33.1
Static route to 10.231.32.0/24 through ipsec

10.231.33.0 <-> 10.231.32.0 works as intended
However each fortigate cannot ping (or reach any other way) the remote subnet, unless source-ip is specified. Is there a way to tell it to use its lan ip to communicate to the remote subnet alway automatically?

Thank you
Regards
Martin

ozkanaltas · Answer

Hello @Wessnitzer ,

If you use a management IP on your FortiGate, FortiGate wants to send all traffic with this IP. If you add this IP address to the ipsec configuration, your FortiGate can access to the other side.

And also I think you can achieve that request with local out routing. You can read about local out routing on this link.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-and-edit-the-Local-out-Routing-Source-IP/ta-p/212877

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/848980/local-out-traffic

Which external connector you couldn't give a source-IP? Some external connecter support that feature but some connectors do not.

Sign up

Login with SSO

Login to the community

Login with SSO