need a routing solution between 2 fortigates

Question

hi allsee attached diagram, it'll help explain it better i don't know how to "attack" thisthank you

ede_pfau · Accepted Answer

Definitively a routing issue, but not on the office FGT but on your office hosts.

Their default gateway has to be 192.168.13.1, the office FGT. These hosts do not need to know anything about the 1.1.1.0 LAN - the default route takes care of all non-local subnets for them.

If the situation at the farm is similar then I suspect that the host settings there are incorrect as well. Farm default gateway is 192.168.16.1.

ede_pfau · Answer

Nice diagram!Imagine you are a packet on the farm's PBX on your way to the main PBX gateway. You need to know the addresses of all routers between you and the target address. On each router on the way, you store the info of target network and (only) it's next hop (= next router address) as a static route. Starting at farm VM (192.168.16.x): target is office PBX gateway at 1.1.1.2541st router is farm FGT (192.168.16.1)needs to know where 1.1.1.0/24 is: via 192.168.13.1so, needs to know where 192.168.13.0/24 is: behind VPN tunnel (no gateway needed here as VPN Ipsec tunnels in FortiOS usually do not have IP addresses at their endpoints ('unnumbered')) Next router is Office FGT (192.168.13.1):needs to know where 1.1.1.0/24 is: via 192.168.13.5 Next router is Office LAN NIC (192.168.13.5):needs to know where 1.1.1.0/24 is: directly connected via 1.1.1.1 So, counting all 'needs to know' you need 4 static routes on the routers involved. BTW, your tunnel needs to carry both the 192.168.13.0 as well as the 1.1.1.0 network (phase2, Quick mode selectors). Just create one phase2 for each network and bind it to the same phase1.

Sign up

Login with SSO

Login to the community

Login with SSO