Skip to main content
Bob_Agoglia
Bob_Agoglia
New Member
April 15, 2021
Question

Traffic from IPSec tunnel to a VLAN

  • April 15, 2021
  • 1 reply
  • 13889 views

I have a Fire Dept station 1 that is connected to our city hall (CH) office via Ubiquity wireless dishes on a VLAN setup in a 100E at CH.  The FD has a remote location, station 2, connected to CH via an IPSec persistent VPN tunnel. There are cameras at FD station 2 that I need to give them access to at station 1.  I have played with routing and policies but I cannot seem to make this work.  I am attaching a diagram of the layout with subnets and hardware models.  You will also notice PW on there but if I can get FD working I can use the same logic to get PW working.

 

Thanks in advance. 

    1 reply

    sw2090
    SuperUser
    sw2090
    SuperUser
    April 16, 2021

    hm that's basically the same what we do bettween HQ and Shops.

    At a Shop there is various vlans for different usages (including wifi) and we need to access all those from HQ.

    Between HQ und Shop there is S2S IPsec like in your case between FD1 and FD2.

    All that is needed to make this work is this (I apply this to your case for you here).

     

    1.Routing:

    FGT at FD1 needs to know a route to the Subnet(s) at FD2 via the IPSec Tunnel (static route with interface and no gateway needed)

    FGT at FD2 needs to know a route to the Subnet(s) at FD1 (static with interface and no gw) to be able to send packets back to FD1

     

    2. Policies

    FGT at FD1 must have a policy that allows traffic from FD1 subnet(s) to FD2 subnet(s). Source interface is the interface(s) the subnet(s) on FD1 are connected to, destination interface is the ipsec tunnel interface to FD2.

     

    FGT at FD2 must have a policy that allows traffic from FD1 subnet(s) to FD2 subnet(s). Source interface is the IPSec tunne interface to FD1. Destination interface is the interface(s) the subnet(s) on FD2 are connected to.

     

    You do not need reverse Policies unless you want to actively establisch a connection from the opposite site too.

     

    diag debug flow filter / trace  pn FGT cli can show you if packets reach the other side and what happens to them afterwards.

    Bob_Agoglia
    Bob_AgogliaAuthor
    New Member
    April 16, 2021

    Thanks for the reply.  There is not a FGT at FD1 only a switch.  FD1 is connected to CH via point to point wireless Ubiquity dishes and the FGT at CH is FD1's router.  CH router has a VLAN set for FD1 and issues IP addresses to that location from CH.  I need FD1's VLAN to talk to FD2's VPN connection that are both in the CH router. I have put policies that allow FD1's VLAN to talk to FD2's VPN and have tried static routes in the CH router and the FD2 router, but a tracert from either location gets no further than their respective routers.

    sw2090
    SuperUser
    sw2090
    SuperUser
    April 16, 2021

    hm. Don't see the problem.

     

    A Client at FD1 is in 192.168.6.0/24 

    as you say the FGT at CH is FD1's router so that to me means that a client at FD1 in 192.168.6.0/24 will have the FGT as default gw (respective its ip on the vlan interface that connects FD1). 

    So all traffic that goes to a destination outside 192.168.6.0/24 will hit the FGT anyways (due to the client's default route). That's the rudimentary basic routing principle in ipv4.

    So the FGT will have to know where to route traffic that should go to FD2 subnet and the FGT at FD2 must know how to route packets back to FD1 subnet. 

    And both need policies to allow the traffic to flow.

     

    I have this here too:

     

    Wifi with Unify APs (each SSID has own vlan) => switches => FGT => IPSec => FGT at HQ.

    Just has ipsec s2s tunnel, routes and policies.

    Terms & ConditionsAccessibility statement