Skip to main content
Demetrios
Demetrios
New Member
January 28, 2018
Question

Metric for VPN routes

  • January 28, 2018
  • 2 replies
  • 10853 views

Hello!

 

Faced with the problem, when VPN clients receive their routes from VPN IPSEC or SSL VPN with metric '1'. Reseived routes take precedence on local routes and broke client routing. 

 

Maybe someone have any idea how to increase routing metric?

 

FG1500D v5.4.8,build1183 (GA)

 

2 replies

FortiKoala
Staff
FortiKoala
Staff
January 29, 2018

Have you enabled split tunnelling? 

http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=FD36253

 

Can you post the "router print" from the client? and highlight the routes with the low metric causing the problem

Demetrios
DemetriosAuthor
New Member
January 29, 2018

Yes, split tunnelling is enable.

 

Активные маршруты: Сетевой адрес Маска сети Адрес шлюза Интерфейс Метрика 0.0.0.0 0.0.0.0 192.168.112.1 192.168.112.18 20 10.9.6.0 255.255.255.0 172.18.8.10 172.18.8.9 1 10.10.0.0 255.255.0.0 172.18.8.10 172.18.8.9 1 10.89.0.0 255.255.0.0 172.18.8.10 172.18.8.9 1 10.89.66.11 255.255.255.255 192.168.112.1 192.168.112.18 21 10.89.66.12 255.255.255.255 192.168.112.1 192.168.112.18 21 10.89.66.13 255.255.255.255 192.168.112.1 192.168.112.18 21 10.89.66.21 255.255.255.255 192.168.112.1 192.168.112.18 20 10.126.0.0 255.254.0.0 172.18.8.10 172.18.8.9 1 10.126.169.74 255.255.255.255 192.168.112.1 192.168.112.18 21 10.126.240.161 255.255.255.255 192.168.112.1 192.168.112.18 21 10.127.17.30 255.255.255.255 192.168.112.1 192.168.112.18 21 10.127.21.1 255.255.255.255 192.168.112.1 192.168.112.18 21 10.127.120.3 255.255.255.255 192.168.112.1 192.168.112.18 21 37.230.149.12 255.255.255.255 192.168.112.1 192.168.112.18 20 169.254.0.0 255.255.0.0 On-link 169.254.71.130 266 169.254.1.1 255.255.255.255 172.18.8.10 172.18.8.9 1 169.254.71.130 255.255.255.255 On-link 169.254.71.130 266 169.254.255.255 255.255.255.255 On-link 169.254.71.130 266 172.16.0.0 255.254.0.0 172.18.8.10 172.18.8.9 1 172.18.8.9 255.255.255.255 On-link 172.18.8.9 257 192.168.112.0 255.255.255.0 On-link 192.168.112.18 276

FortiKoala
Staff
FortiKoala
Staff
January 30, 2018

The following routes are taking precedence because of the lower subnet mask

 

10.9.6.0/16 255.255.255.0

Local 10.9.6.x routes 10.10.0.0/16 255.255.0.0

Local10.10.6.x routes 10.89.0.0/24 255.255.0.0

Local10.89.0.x routes

 

This means that the FortiClient interface is prioritised over your local routing and interface. 

 

[size="2"]On your FGT VPN conf you will need to remove the advertising of the routes if they are local to the FortiClient network, limit to the networks to the actual networks behind the FGT rather than class B subnets[/size]

 

[size="2"][size="2"]10.89.0.0/24 255.255.0, [size="2"]10.9.6.0/16 255.255.255, 10.126.0.0 255.254.0.0  [/size] [/size][/size]

 

 

Terms & ConditionsAccessibility statement