redirect internet traffic over IPSec tunnel

Question

Hello,

I am implementing a scenario in which I have branches connected to the headquarters through IPSec tunnels.

In my environment, I need to direct all traffic originating from the branch's local network through the IPsec tunnel so that this traffic destined for the internet uses the headquarters' WAN.

For other services at the branch, I need to use the local WAN link.

For example, branch office ether1, network 192.168.56.0/24, all traffic must be routed through the IPsec tunnel.

As for ether2, network 172.16.56.0/24, traffic must be directed through the local WAN.

I already have this working environment, I am using IPsec SDWAN to close the tunnels, make them redundant across different WANs and my question/problem is the following.

For traffic originating from the branch network, 192.168.56.0/24 and destined for the internet to work, I must have a static default route created in the headquarters firewall, with gateway to the WAN 10.100.100.2, without this, navigation will not be possible. It doesn't works, even using an SDWAN rule to route, only navigation through the tunnel works if I have this default route active.

The problem is that, for this WAN, 10.100.100.2, I need to direct ONLY the traffic originating from the units' remote networks, other traffic I cannot direct to it, that is, the default route becomes a problem in my case.

I have been researching, but so far I have not been successful in finding a configuration recommendation for this environment, in which I need to be able to somehow use WAN1 (10.100.100.2) as the default route only for specific source networks, in practice, I would like to use SDWAN for this, but it didn't work in my environment.

I would like to know what the community recommends in this case.

Thank you very much in advance.

vpn fortinet (2).png

HiralShah · Accepted Answer

Hello @TSTelecom

In this case, You can use policy route: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-p/189996

So you can send the traffic for specific remote network to wan2.

Umer221 · Answer

Hello,

To my understanding, you are trying to route all the internet traffic from the branches to the HQ connected via IPSec Tunnel.

In simple terms theoretically, you have 3 options:
1. Create an SD-WAN rule on the branches with source to their local networks and destination set to all; while destination interface should be the HQ IPSec Tunnel interface.
2. Create a static route with 0.0.0.0/0.0.0.0 and the outgoing interface set to the HQ IPsec Tunnel, as long as you have static IP assigned to branch WAN ports.

3. Create a policy route and enable Outgoing interface as HQ IPSec Tunnel:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-p/189996

If any of these options do not work, then probably needs to be troubleshoot.

Sign up

Login with SSO

Login to the community

Login with SSO