Visitor III

Question

Policy based Ipsec VPN strange behaviour

Forum|Forum|3 years ago
June 6, 2023
7 replies
4702 views

Hi Team,

I have the following issue:

I created a Policy based Ipsec tunnel, with a specific source IP subnet, and destination subnet is set to "all". The specific source subnet is routed into the Ipsec tunnel, it's ok. But the fortigate do some strange things. It routes all traffic initiated from it's every VLAN interface IP to the tunnel and it's a problem for us. Only traffic from it's own IP, traffic from client's is not routed into the tunnel.

Do somebody know the reason for that?

Thank you!

Best Regards,

Istvan

FortiGate

AlexC-FTNT

Staff

I'd start with basic checks for routing. This is clearly a misconfiguration.

get router info routing-table all

get router info routing-table detail x.x.x.x (use the destination IP)

akristof

Staff

Hello,

If it is policy-based Ipsec VPN, I would start first converting it to route-based, aka Interface-based VPN unless you have policy-based VPN for some specific reasons. How does your firewall looks like that has action "Ipsec"? With policy-based Ipsec, traffic is not really controlled by routes, but by policies - hence the name. So If you want only specific traffic to enter VPN, change destination address to specific subnet that needs to be routed out via tunnel.

istvanmarlokAuthor

Visitor III

Hello,

The reason why I made a policy based Ipsec is that I would like to put only one specific source subnet into to ipsec, but from that subnet to all destination.

So my firewall policy looks like so:

source: specific subnet

destination: all

source interface: interface for the specific subnet

outgoing interface: wan interface

action: ipsec

I tried to make it with interface based solution too, but with no luck. How should routing looks like there? I think that we can do only with policy routing, so if the source ip is from the specific subnet then route it into the tunnel. Is that true? I think only with static routes it's not possible, because the destination for that traffic is "all"

Istvan

akristof

Staff

Hi.

With route-based VPN it is very easy. You have multiple ways how to "restrict" access to VPN for only specific subnet:

1) Specific source/destination selectors

2) Destination route towards IPSec will be specific, only subnet you want to access

3) In firewall policy you can grant access same as in policy-based, with source/destination address. Only difference is that outgoing interface will be selected based on route.

This is example for IPsec with specific selectors. You can ignore that it is for 7k FortiGate, idea is the same:

https://docs.fortinet.com/document/fortigate-7000/5.4.9/fortigate-7000-handbook/100094/adding-source-and-destination-subnets-to-ipsec-vpn-phase-2-configurations

Faiza_Emam_Delhi

Visitor III

It seems like the FortiGate is routing all traffic initiated from its VLAN interfaces to the Policy based IPsec tunnel because the destination subnet is set to "all" in the IPSec configuration.

To resolve this issue, you can try configuring the destination subnet to only include the specific subnet that you want to route through the IPSec tunnel. This will ensure that only traffic from the specific subnet is routed through the tunnel, and traffic from other VLAN interfaces is not routed through the tunnel.

You may also want to check the routing table on the FortiGate to ensure that the routes are properly configured for the specific source subnet. If the routing table is not properly configured, it can cause traffic from other VLAN interfaces to be routed through the IPSec tunnel as well.

Sign up

Login with SSO

Login to the community

Login with SSO