6.0.6 - Route a IPSEC subnet to another IPSEC

[marcomiano]

Hello Guys,

i have a strange question:

i have two IPSEC tunnels as below:

branch 01 ----- HQ ------ azure

ip1 -> iphq    iphq->ip1

                   iphq+ip1->ipaz       ipaz->iphq+ip1

we can't have any more IPSEC tunnel on brach01 so i'm trying to route the subnet ipaz presented by the tunnel between hq and azure to branch01 and vice versa.

I think i'm missing something in between also i can't nat because we have video traffic that don't like nats.

any ideas?

THX a lot!

[kcheng · Accepted solution]

Hi,

You should be able to achieve the respective with the following:

1. In HQ, ensure that branch local subnet is included as the local subnet in the Phase2 between the VPN tunnel of HQ - Azure, and the subnet of Azure is included as the local subnet for Phase2 between VPN tunnel of HQ and Branch01

2. Ensure that there is a policy in HQ that allows traffic between IPSec_Branch01 - IPSec_Azure and reverse policy

3. If HQ is able to connect to Branch01 and Azure without any issue, I believe the static route is already in place

4. In Branch01, make sure that remote subnet for Azure is configured in Phase2 selector for the IPSec tunnel between Branch01 and HQ

5. Ensure that Azure remote subnet is included in the firewall policy for local port to IPSec_HQ in Branch01

6. Ensure that Azure firewall is configured to permit traffic as well

If you already have all the above in place and still not able to reach to Azure site from Branch01, I would suggest you run the following commands on all the firewall (if they are all FortiGate) to check what could be the root cause:

diag deb flow filter saddr <source_IP_from_branch>

diag deb flow filter daddr <destination_IP_on_Azure>

diag deb flow sh function-name en

diag deb flow sh iprope en

diag deb flow trace start 20

diag deb en

Then, test the connection from Branch01 user and check how is the traffic being processed.

[ede_pfau]

It doesn't suffice to just have 2 routes in place. Each subnet needs to know how to reach the other 2 subnets, and that calls for 2 routes.

in branch:

route to HQ

route to AZ

in HQ:

route to branch

route to AZ

in AZ:

route to HQ

route to branch

As the FGT is not only a router but a firewall, you need to allow those subnets in policies. Just use 2 address objects in the ingress and egress policies, on each FGT.

Of course, everything else in Kayzie's answer is 100% correct and helpful. 'diag debug flow' will show exactly what is going on, if you think that routes and policies are all in place and it still doesn't work.

[marcomiano]

Hi guys,

Thanks a lot for all the help,

i tried both solutions and it doesn't work. azure side i have all the configuration in place (the tunnel si up and the phase 2 is up and running) azure automatically create the correct route and is identical for the other subnets.

when i execute the debug command i never receive any packets. i also tried reversing the filter to be able to initiate the connectio from azure to branch01. and it seams the firewall in hq doesn't ever receive any packets from azure to branch01 in for that subnet. I did the same tests using the other subnets between azure and HQ and the test show all tha packets.

i'm blaming azure now.

i'll update if i can find a solution azure wise.

thanks again