Technical Tip: How to configure ALL traffic to be sent through an IPsec tunnel

[Gab_FTNT]

Description	This article describes the required routing configuration to forward all traffic through an IPsec tunnel.
Scope	FortiOS.
Solution	In some scenarios, it is required to forward forward all traffic to an IPsec tunnel on the FortiGate. This example shows the scenario and explains the required routing configuration. Site A has to forward all traffic to Site B. Since ALL traffic has to be forwarded, the default Static route can be configured as follows. Routing table for VRF=0 S* 0.0.0.0/0 [1/0] via A_to_B tunnel 10.9.12.146, [1/0] However, the Phase1 negotiation of the IPSec tunnel has to be sent through the WAN interface for the tunnel to established. A solution for this is to create a Static route to reach the remote public IP through Wan1. Routing table for VRF=0 S* 0.0.0.0/0 [1/0] via A_to_B tunnel 10.9.12.146, [1/0] S 10.9.12.146/32 [10/0] via 10.9.15.254, port1, [1/0] This route will let the FortiGate know how to reach the Remote IP of the tunnel for the negotiation.