Skip to main content
Virgule59
Virgule59
New Member
September 6, 2022
Solved

Internet routing throug vpn ipsec

  • September 6, 2022
  • 3 replies
  • 5235 views

Hi,

 

I would route internet access throug a vpn ipsec for one of my customer, but i'v figured out that if i'll do this like this: 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719

 

All of internet will be route throught the VPN of this customer. I try with vrf but my version 6.0.9 only support vrf for blackhole. How can i do this ?

 

Thank for your reply

Best answer by kvimaladevi

Hi Virgule59,

 

I understand that you would like to route some traffic over the tunnel and not the entire traffic. As per the link you have provided, they have created a static route for all the traffic to go through the tunnel

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719

Instead of using 0.0.0.0 you can specify the exact subnet details that has to  be reached over the tunnel so that only that traffic goes through the tunnel and the rest through your wan or other interfaces.

 

Regards,
Vimala

3 replies

aionescu
Staff
aionescu
Staff
September 6, 2022

Hi @Virgule59 , 

 

Welcome to the community. 

It is not clear what you want to achieve - you would like to send only some traffic via the tunnel?

If it is the case, you can use policy based routing ase explained here: Technical Tip: Configuring the firewall Policy Rou... - Fortinet Community

If it is not the case, can you provide more details, please?

kvimaladevi
Staff
kvimaladeviAnswer
Staff
September 7, 2022

Hi Virgule59,

 

I understand that you would like to route some traffic over the tunnel and not the entire traffic. As per the link you have provided, they have created a static route for all the traffic to go through the tunnel

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719

Instead of using 0.0.0.0 you can specify the exact subnet details that has to  be reached over the tunnel so that only that traffic goes through the tunnel and the rest through your wan or other interfaces.

 

Regards,
Vimala

Virgule59
Virgule59Author
New Member
September 7, 2022

Hi,

Yes this is exactly what i want to do, i didn't even think do to that on the router..., but think to do that on the server. on the web link, the vpn interface is configure with an ip, this is mandatory or just a best practice. What the goal of this ip ?

 

Does in the new firmware, i can use VRF to manage mutliple routing table, today i can only route to a black hole ?

 

Best Regard. 

kvimaladevi
Staff
kvimaladevi
Staff
September 7, 2022

Hi Virgule59,

"the vpn interface is configure with an ip, this is mandatory or just a best practice. "

May I know if you are referring to the Remote IP that is configured on the VPN configuration?

Regards,
Vimala

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
September 7, 2022

Basically this is solely a routing issue. To route all internet bound traffic into a tunnel, you have to have your remote side's default route into the tunnel. However, if you do that the tunnel peer IP would go with it and can't reach the peer IP (HUB side) outside the tunnel then it would result in that the tunnel keeps bouncing up and down. That's why you have to have the peer IP /32 static route to the interface/outside of the tunnel.

 

This means the HUB's peer IP has to be static, or you have to use DDNS then use the FQDN for the /32 static route.

 

It doesn't matter if it's under VRF environment or VDOM environment since it's a routing issue. You have to set up the routing environment in the particular routing table. This apply to or work with any routing devices not only FortiGate, but also like Cisco, Juniper, etc.

 

Toshi

Terms & ConditionsAccessibility statement