New Member

Question

Zones - members not available as src or dest interface

Forum|Forum|14 years ago
February 16, 2012
16 replies
7492 views

Hi I have configured a zone with two IPSec tunnels as its member. Both tunnels route traffic to the same remote FTG, one via an expensive link and the other via ADSL. I would like to apply different traffic prioritisation profiles to traffic in each tunnel for one type of traffic. But, it seems that since creating the zone I can not use either member of the zone as a destination interface in a firewall policy. Is there a way around this? I do not want to duplicate all my rules - Zones are a good solution for this. Thanks

rwpatterson

New Member

Well if the tunnels are in interface mode, then you have a destination on the other end you can route to. From the CLI, you can set the priority on the static routes. Lower number=higher priority. Each tunnel may (should) have a unique end point.

riaanbAuthor

New Member

Yes, the VPNs are in interface mode. The problem is, at least I think it is, that I have added those interfaces into a zone. I think of the name I gave the phase 1 configuration as the name of the interface, is this correct? So, I had to VPNs, which I called CPT-BL-JNB and CPT-DSL-JNB - these two interfaces are now members of the zone CPT-VPN-JNB I have firewall policies that says: on int1 from local-lan to remote LAN via CPT-VPN-JNB type RDP traffic-shaper HIGH ... etc. What is the destination on the other end that you refer to? How do I specify that in my destination interface?

emnoc

New Member

I don' t think you can do that. Zone-groups does that, just group interfaces that requires the same policies. How many fwpolicies do you currently need to control over CPT-VPN-JNB?

rwpatterson

New Member

The static route is built to the interface though, not the zone. I just put some IPSec tunnels into a vendor zone. The VIPs that they have still terminate at the interface, not the zone.... Weird, kinda hard to wrap your head around, but yes. Policies use the zone, routing and VIPS use the interface (even though it' s in the zone).

riaanbAuthor

New Member

I have about 14 policies, so if I have to double them up it would be not too many. But it does complexity for support over the next few years. Bob, are you saying you setup Virtual IPs and used these in firewall policies? I assume one VIP uses on VPN and the VIP the other VPN. What do oyu use as the destination interface? any?? Do you mind giving me an example?

rwpatterson

New Member

Sure. You have a server on the internal port (192.168.1.2/24), and use WAN1 and WAN2 for Internet (from your ISPs).

    config system interface      edit " internal"           set vdom " root"           set ip 192.168.1.1 255.255.255.0          set allowaccess ping https ssh snmp telnet          set type physical          set description " Inside (gateway) interface"       next      edit " wan1"           set vdom " root"           set ip 10.10.10.1 255.255.255.0          set allowaccess ping https          set type physical          set description " Outside (Internet) interface"           set alias " ISP1"       next      edit " wan2"           set vdom " root"           set ip 10.10.20.1 255.255.255.0          set allowaccess ping https          set type physical          set description " Outside (Internet) interface"           set alias " ISP2"       next  end

Putting WAN1 and WAN2 into the ' Internet' zone, policies would be written ' internal -> Internet' .

  config system zone      edit " Internet              set interface " wan1"  " wan2"       next  end

Routing would still need static routes to both ISP' s (with weights and/or fail over configured). The VIP definitions would be:

  config firewall vip      edit " vIP.wan1 HTTP"           set extip 10.10.10.2          set extintf " wan1"           set portforward enable          set mappedip 192.168.1.2          set extport 80          set mappedport 80      next      edit " vIP.wan2 HTTP"           set extip 10.10.20.2          set extintf " wan2"           set portforward enable          set mappedip 192.168.1.2          set extport 80          set mappedport 80      next  end

Notice, nowhere do you see any reference to the zone. Zones are only for configuring policies. The inward policies for the web server would be:

  config firewall policy      edit 1          set srcintf " Internet"           set dstintf " internal"               set srcaddr " all"                            set dstaddr " vIP.wan1 HTTP"                        set action accept          set comments " Web server traffic"           set schedule " always"               set service " HTTP"                    next      edit 2          set srcintf " Internet"           set dstintf " internal"               set srcaddr " all"                            set dstaddr " vIP.wan2 HTTP"                        set action accept          set comments " Web server traffic"           set schedule " always"               set service " HTTP"                    next  end

emnoc

New Member

Good job rwpatterson, but for traffic priorization that would be for outbound. How would the OP conduct that level priorization for let' s say voice ? and from " internal" to " internet" ? I think that was where riaanb is going with this. I think that' s area that I' m not clear on and in regards to his zone-grouping.

rwpatterson

New Member

Static routes and priorities work, but that' s about it. If it worked with 2 wan ports, it will still work, just now it' s under one policy. Policy routing will still work as well. I' m doing this currently with one of my clients. Just ironed it out a couple of days ago. What a friggin PAIN! <detail> Wan1 50/50Mb, static route priority 10 Wan2 10/2Mb, static route priority 20 (lower, backup circuit) They needed to use mail service on the backup WAN' s server, so I created a policy route for mail (port 25) to the wan2 server. Works like a charm. All other traffic, VIPs, IP phones (yuck!), etc. are on wan1. </detail>

riaanbAuthor

New Member

Hi Bob Thanks for taking the time posting so much details. I am afraid that I still do not see how this will help me prioritise traffic on a specific IPSec VPN different from a different VPN - when both VPN interfaces are part of a zone. Emnoc, I agree, I am interested in outbound prioritisation. In case it is not clear CPT-BL-JNB and CPT-DSL-JNB are two VPNs that terminate between the same two offices routed via different mediums. The idea is to use the DSL VPN as a failover for the other link. But because the DSL is contended we need to apply different traffic shaping prioritisation when in failover. Looks like I will have to dismantle the zones and duplicate the firewall policies... [:' (] edit - spelling

ede_pfau

SuperUser

Maybe you' ve overlooked the priorisation you can achieve by using different weights (distance/priority) on the static routes to the VPNs. If one of the routes has a smaller distance or a lower priority then it will be preferred over the other. This is the classical failover scenario with 2 outbound interfaces (only normally you' d use it on WAN ports, not VPN ports). As Bob has pointed out, even if both VPN interfaces are members of a zone you can still set their priority independently in the Interface setup. Of course you should additionally configure both interfaces for Dead Gateway Detection at the interface level, i.e. set ping targets. This way, if an interface fails (the tunnel goes down) the static route to it will quickly be removed from the routing table so that traffic won' t be sent to Nirwana.

riaanbAuthor

New Member

The problem with using static routes is that my requirement is for inter-branch traffic. So, there are two static routes between CPT and JNB - one via the " BL" VPN and the other via the " DSL" VPN. The DSL VPN has a a higher weight than the BL VPN. Are you saying I could have a route for 192.168.10.0/24 via both VPN interfaces and specific routes for 192.168.10.100/24 with different weights - where 192.168.10.100 is a VOIP PBX which I want to handle differently depending on which VPN is my default route between the branches? How does this allow me to prioritise RDP traffic over SIP traffic when we are on the failover VPN between the branches? PS - BL is a MPLS network between the two branches the DSL link is highly contended and inexpensive.

riaanbAuthor

New Member

Just a quick note to say thanks for all the responses so far.

ede_pfau

SuperUser

Now, this is 2 pairs of shoes: preference of a (less costly) route over a backup route, and prioritisation of one service over others. The first goal can be achieved with routes which have different weights. Of course you can specify a host route (in your case 192.168.10.100/32). If placed before the general route for that subnet it will be followed if traffic to that destination is to be routed. The means to achieve traffic prioritisation is the traffic shaper option available in firewall policies. TS places services into 3 QoS categories (low/medium/high). You separate the services by defining specific policies. Then you are able to assign TS to them, with different QoS classes. The FortiOS implementation is not very sophisticated IMHO but it works. As this is a tricky subject I recommend the FortiOS Handbook (and maybe the Cookbook also) for further reading.

Show more replies

Sign up

Login with SSO

Login to the community

Login with SSO