Skip to main content
RPLittledevilcomputers
RPLittledevilcomputers
New Member
July 18, 2021
Question

Routing Internet IP via IPSEC

  • July 18, 2021
  • 4 replies
  • 3655 views

fortigate 60E 6.4

as an example i'm trying to route whatismyip.com via ipsec tunnel  router1 to router2  

Router 1 192.168.1.0/24

Router 2 192.168.2.0/24

I can ping anything on router 2 so i can confirm the tunnel is up

but when i try to traceroute whatismyip.com it hangs at my router.

can you help me figure out what i'm doing incorrectly? 

Thanks

 

Details 

 

I have an FQDN that resolves whatismyip.com with its 2 addresses  named test

 

I have policy that routes

incoming interface inside 

outgoing router1 to router2 

source all

destination test

schedule always

service all

action accept

inspection mode flow based

 

firewall NAT enabled 

no security profile 

log enable 

policy enabled 

 

I have a static router set 

named test

interface router1 to router2 

admin distance 10 

 

I can run a policy lookup 

inside 

protocol ip

protocol number 1

source 192.168.1.100

destination test 

 

it will show that the above policy is the one selected 

 

 

 

 

 

    4 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    July 18, 2021

    Not clear about the topology. Is the 60E = Router2? Or, it sits inbetween Router2 and Internet?

    RPLittledevilcomputers
    RPLittledevilcomputersAuthor
    New Member
    July 18, 2021

    both routers are 60E's   

    LAN Traffic to whatismyip.com needs to go from router 1 to router 2 then to the cloud 

    there is a tunnel already setup between the 2 gates 

     

     

     

     

    note whatismyip.com is just an example and not the actual website i'm trying to route but used for the example only.  so if router 1 public ip  is  20.20.20.20 and router 2 30.30.30.30 then whatismyip.com would show 30.30.30.30 as the ip i'm coming from.  currently whatismyip.com is just stopping at router1  

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    July 19, 2021

    You must have a set of inbound and outbound policies on both ends without NAT to let 192.168.1.0/24 and 192.168.2.0/24 talk each other over the tunnel. Then your test route pushes traffic to the destination into the tunnel, if the phase2-selectors are including the destination: 192.168.1.0/24<->test. If you're using 0/0<->0/0 for the selector, it includes everything so that's not a problem.

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.