Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
DavidC
New Contributor

Routing problem between 2 FG Tunnel VPN IPsec

Hello,

 

I need help solving a routing problem.

 

HQ and Brand Fortigate FW are connected via VPN IPsec Site to Site, everything is working fine, we can ping and have access from servers and ressources LAN to LAN from both side. 

 

I created a static route from Brand's LAN 10.0.151.0/24 to HQ's router 10.0.78.253 on Firewall Arkoon.

 

We host a SaaS solution with a service provider and this one to authorize the different lan to connect to the solution (France agencies + UK agency)

 

On our Arkoon Firewall, we have authorized the different LANs that must have access to the LAN of the SaaS solution, 192.168.100.0/24.

 

This works very well for all the agencies in France, except for the UK LAN with 10.0.151.0/24 addressing.

 

When i do tracert cmd from a computer brand's LAN 10.0.151.109, I can ping 10.0.78.253 and 10.0.78.254.

But, when I try ping or tracert with 192.168.100.20 it cannot found a route and it fails at first jump after 10.0.151.254.

 

Thank you in advance.

 

You can find on my screenshoot : Fortigate FW UK - static routes, ipv4 rules and topology network.

Regards,

1 Solution
Phil_Lofthouse

Hi David.

 

It looks like you will need an additional Phase 2 configuring on the Branch FortiGate, to allow 10.0.151.0/24 (local) to have a tunnel to 192.168.100.0/24 (remote), with the opposite configured on the HQ FortiGate.

 

Regards,

Phil

View solution in original post

13 REPLIES 13
DavidC

Phil Lofthouse wrote:

Hi David.

 

It looks like you will need an additional Phase 2 configuring on the Branch FortiGate, to allow 10.0.151.0/24 (local) to have a tunnel to 192.168.100.0/24 (remote), with the opposite configured on the HQ FortiGate.

 

Regards,

Phil

I added the additional phase 2 as shown and by changing the ipv4 policy from HQ to branch.

It works perfectly, thank you all for your help.

DavidC

Phil Lofthouse wrote:

Hi David.

 

It looks like you will need an additional Phase 2 configuring on the Branch FortiGate, to allow 10.0.151.0/24 (local) to have a tunnel to 192.168.100.0/24 (remote), with the opposite configured on the HQ FortiGate.

 

Regards,

Phil

I added the additional phase 2 as shown and by changing the ipv4 policy from HQ to branch.

It works perfectly, thank you all for your help.

Terrell761

Phil, for my education; what did you see from the information provided to provide that answer? I am looking and I see nothing about Phase 2 mismatched. But, I am a novice.

Yurisk
Valued Contributor

What Phil says, David, beyond routing to the 192.168 via VPN tunnel interface, you have to add Phase 2 Selectors for the networks in question as well.

In Phase 2, I have set Local Address Branch-to-HQ_local 10.0.151.0/24 and Branch-to-HQ_remote 10.0.78.0/24.

 Thank you in advance, 

 Regards.

Yuri
https://yurisk.info/ blog: All things Fortinet, no ads.


All opinions are mine only.