Not able to select remote subnet by named address in static routes

3 replies
64 views

Setting up an IPSec VPN Tunnel between a Fortigate 90g and another device. On the Fortigate, I setup the tunnel, settings are good.

Setup the firewall policies, I see the created network names (local_subnet_1 and remote_subnet_2) that the Fortigate creates.

When I go to Static Routes, I cannot select, nor can I even see, the remote_subnet_2 as a selection when I set Destination to Named Address.

I CAN see names of other remote networks named with the creation of previous tunnels.

Previous tunnels setup, uses the named network, without issue.

Does the Fortigate create the name automatically? and If so, why isn’t this one showing up in the list? I can manually add the subnet, but for consistency in setup with the other tunnels on the device (2), I’d like to use the same method.

FortiGate

funkylicious

SuperUser

is because the param in the address object for static routing isnt enabled more likely ( set allow-routing enable , under config firewall objects )

"jack of all trades, master of none"

sw2090

SuperUser

could that be due to the fortigate crating the address object to an interface when it creates it and the route not using that interface as destination?

You could check for that by editing that address object and see if it lists a specific interface or just “any”. If it does set it to “any” and then try to use that in the route again.

xshkurti

Staff

@srenton
As @funkylicious stated, this is because of the address group should have the routing option enabled:

config firewall address
edit "test"
set allow-routing enable <------
set subnet 10.10.10.0 255.255.255.0
next
end

If this is not enabled: