I need help with routing on Fortigate.

9 replies
1034 views

Solved.

FortiGate

Toshi_Esumi

SuperUser

Unless both are NOT DHCP/PPPoE circuits (you sounded like), you have to configure separate GWs in two static default routes. Even DHCP/PPPoE where you don't need to configure static default routes, when you check your routing table, you should see two default routes. Below is mine with three default routes:

fg40f-utm (root) # get router info routing-t all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [1/0] via x.x.x.x, a, [1/254]
[1/0] via SFOviaCentu tunnel x.x.x.x, [1/253]
[1/0] via x.x.x.x, ppp3, [100/255]

<snip>

What do you see in your routing table? The first one is DHCP, the second is static (from "0/0 to virtual-wan-link"), and the last is PPPoE.

Toshi

renanrdriguesAuthor

Explorer II

It's not DHCP, the two links are dedicated:

get router info routing-t all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [1/0] via 187.23.200.39, VLAN200, [1/0]
[1/0] via 200.40.221.11, VLAN201, [1/0]

Toshi_Esumi

SuperUser

Looks fine to me, except those .38 and .10 are GW IPs in your static default routes, not the IPs on the FGT's interfaces unless you modified the output of the command.

Toshi

Toshi_Esumi

SuperUser

What do you mean by "aggregate"? If they're VLANs, those are VLANs on top of physical interfaces like wan1 or LAG. And none of those physical interfaces would show in your SD-WAN member config, but VLAN interfaces should be the members.

So you're saying VPN from/to (you didn't say either site-to-site or remote access VPN) VLAN201 doesn't work? Is the IP consistently pingable from outside/over the internet? Or depending on the destinations?

Toshi

renanrdriguesAuthor

Explorer II

Yes, a LAG.
The links are connected to the switch and pass through the trunk to the Fortigate.

I put WAN to make it easier to understand.

VPN with vlan200 (187.23.200.39) is intermittent, as if it were asymmetrical, sometimes it works and sometimes it doesn't.

And when I do a tracert from my Fortigate to my partner's Fortigate, the result is that it goes out through the other link, vlan201 (200.40.221.11).

Toshi_Esumi

SuperUser

So those are site-to-site VPNs then. At the partner side do they have static public IPs on the interface as well? If so, you can put a /32 static route to either vlan200 or vlan201 so that it won't flip-flop.
Also in the IPsec phase1-interface config, you needed to specify the outgoing interface either vlan200 or vlan201.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO