Skip to main content
FrontDoor12
New Member
February 24, 2020
Question

IPSEC Tunnel Static Route

  • February 24, 2020
  • 3 replies
  • 12989 views

Hello All and thanks for the help in advance:

 

I have two Fortgate firewalls I have inherited and I am in need of some help.  At the head-end, I have a 90D and at the remote-end, I have a 90E.  The IPSEC tunnel had been created and I am trying to add in a route to a new network at the head end. 

 

So the network looks something like this:

 

192.168.20.0/24

192.168.1.0/24

-------------------

90D (192.168.1.28)

-------------------

Internet

-------------------

90E (192.168.2.253)

-------------------

192.168.2.0/24

 

I can get from 192.168.2.0 to 192.168.1.0 with no issues.  That was the IPSEC tunnel that was created before.  I am trying to add 192.168.20.0 

 

Attached to the 90D, I have a Cisco L3 switch (192.168.1.2) that acts as the router to the 20 network. The Cisco has a default route to the 90D (192.168.1.28) From the 20 network today, I can surf the web which is out of the 90D, but I cannot get to anything in the 192.168.2.0 network on the other side of the tunnel.  Nor can I get from .2 to anything on the .20 network

 

Traceroutes from the 192.168.2.0 to the working 1 network shows (from 192.168.2.95 to 192.168.1.250): 

 

Tracing route to 192.168.1.250 over a maximum of 30 hops

 

  1    <1 ms    <1 ms    <1 ms  192.168.2.253

  2    35 ms    37 ms    36 ms  192.168.1.28

  3    37 ms    36 ms    37 ms  192.168.1.250

 

Trace complete.

 

Traceroutes from the 192.168.2.0 to the new 20 network show (from 192.168.2.95 to 192.168.20.53):

 

Tracing route to 192.168.20.53 over a maximum of 30 hops

 

  1    <1 ms    <1 ms    <1 ms  192.168.2.253

  2     *        *        *     Request timed out.

  3     *        *        *     Request timed out.

  4     *        *        *     Request timed out.

 

 

I have added static route to the 90E, I thought that would fix the problem.  However, all I can do is tell it that the endpoint is the tunnel, not the router on the other end (192.168.1.2)

 

Any help would be appreciated.  

 

Thanks again

3 replies

Toshi_Esumi
SuperUser
SuperUser
February 24, 2020

Did you configure a set of tunnel interface IPs on both ends of the tunnel? Just need to point the static route for .20.0/24 to the remote-ip (as gateway) and specify the tunnel name (as device).

rwpatterson
New Member
February 24, 2020

Make sure that the distance is SHORTER than that of the default gateway. Leave it at 10 and you'll get nowhere, usually.

FrontDoor12
New Member
February 24, 2020

Lowered it, but it made no difference.  

 

Thanks!

FrontDoor12
New Member
February 24, 2020

Just adding to this.  

 

config router static      edit 1             set gateway 12.43.15.225             set device "wan2"      next      edit 2             set gateway 14.100.22.65             set device "wan1"      next      edit 3            set dst 192.168.1.0 255.255.255.0            set device "To_HQ"            set comment "VPN: To_HQ (Created by VPN wizard)"      next      edit 4            set dst 192.168.1.0 255.255.255.0            set device "To_HQ_WAN2"            set comment "VPN: To_HQ_WAN2 (Created by VPN wizard)"      next     edit 5           set dst 192.168.1.0 255.255.255.0           set device "To_REM2_HQ1"           set comment "VPN: To_REM2_HQ1 (Created by VPN wizard)"     next     edit 6           set dst 192.168.1.0 255.255.255.0           set device "To_REM2_HQ2"           set comment "VPN: To_REM2_HQ2 (Created by VPN wizard)"     next     edit 7           set dst 192.168.20.0 255.255.255.0           set distance 5           set device "To_HQ_WAN2"     next end

 

 

FrontDoor12
New Member
February 24, 2020

FGT90E4Q17002511 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP            O - OSPF, IA - OSPF inter area            N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2            E1 - OSPF external type 1, E2 - OSPF external type 2            i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area            * - candidate default

S*          0.0.0.0/0 [10/0] via 14.100.22.65, wan1 C            14.100.22.64/28 is directly connected, wan1 S            192.168.1.0/24 [10/0] is directly connected, To_HQ_WAN2 C            192.168.2.0/24 is directly connected, internal S            192.168.20.0/24 [5/0] is directly connected, To_HQ_WAN2

Toshi_Esumi
SuperUser
SuperUser
February 24, 2020

You have 4 tunnels to reach 192.168.1.0/24 configured: To_HQ, To_HQ_WAN2, To_REM2_HQ1, and To_REM2_HQ2.

You need to figure out why there are 4 tunnels and their intended purposes. But based on the routing-table, currently only To_HQ_WAN2 seems to be up.

You also need to make sure .20.0/24 is in phase1-selectors if you're not using 0/0<->0/0.

Virgule59
New Member
February 25, 2020

Hi,

 

Do you create a policy for this new route ?

 

Regards

 

Too late I don' t see the last message...