Skip to main content
jayzer08
jayzer08
New Member
May 31, 2021
Question

Need help creating route between 2 fortigate firewalls

  • May 31, 2021
  • 1 reply
  • 4332 views

Hi

 

I need help I have 2 Fortigate I need to make connectivity between these 2 firewalls by using vlan 51 each site has different vlan that i want to access on both sites i have a diagram.

1 reply

sw2090
SuperUser
sw2090
SuperUser
May 31, 2021

hm on your diagram I see:

 

both FGT are connected via the same subnet and vlan (172.168.201.0/?? and VID 51). This implies both FGT do have an interface in that vlan and subnet. So they already bascially have a (connected) route. This is automagically there once there is an interface connected to that subnet and vlan.

So if clients/servers/devices behind the FGTs use the corresponding FGT as default gw you will only need static routing for the subnets behind the FGTs plus policies to allow the traffic you need to flow.

 

So on VCK you would probably need those static routes:

 

172.16.35.0/24 with gw 172.168.201.20

10.10.10.0/24 with gw 172.168.201.20

10.10.20.0/24 with gw 172.168.201.20

10.10.30.0/24 with gw 172.168.201.20

 

and on MK2 you migh need:

 

172.17.200.0/24 with gw 172.168.201.10

10.17.100.0/24 with gw 172.168.201.10

 

because the routing is the first thing the FGT looks at when it is hit by traffic.

When a route has been found the FGT uses that to determine if there is a matching policy to allow the traffic.

 

jayzer08
jayzer08Author
New Member
May 31, 2021

Oh! THANKS!

jayzer08
jayzer08Author
New Member
June 9, 2021

Hi 

I'm having issue at MK2 site i cant access the DR site VCK pleae see the debug trace below

 

PSAFG301EMK2 # id=20085 trace_id=9697 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55343." id=20085 trace_id=9697 func=init_ip_session_common line=5788 msg="allocate a new session-24409910" id=20085 trace_id=9697 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9697 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9698 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55349." id=20085 trace_id=9698 func=init_ip_session_common line=5788 msg="allocate a new session-24409aa1" id=20085 trace_id=9698 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9698 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9699 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55356." id=20085 trace_id=9699 func=init_ip_session_common line=5788 msg="allocate a new session-24409c74" id=20085 trace_id=9699 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9699 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9700 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55363." id=20085 trace_id=9700 func=init_ip_session_common line=5788 msg="allocate a new session-24409e25" id=20085 trace_id=9700 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9700 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)"

 

PSAFG301EMK2 # id=20085 trace_id=9701 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55474." id=20085 trace_id=9701 func=init_ip_session_common line=5788 msg="allocate a new session-2440b660" id=20085 trace_id=9701 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9701 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9702 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55481." id=20085 trace_id=9702 func=init_ip_session_common line=5788 msg="allocate a new session-2440b7d8" id=20085 trace_id=9702 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9702 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9703 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55488." id=20085 trace_id=9703 func=init_ip_session_common line=5788 msg="allocate a new session-2440ba18" id=20085 trace_id=9703 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9703 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9704 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55495." id=20085 trace_id=9704 func=init_ip_session_common line=5788 msg="allocate a new session-2440bbdf" id=20085 trace_id=9704 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9704 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)"

Terms & ConditionsAccessibility statement