5.6.2 Policy routing for Fortiguard services

[Wayne11]

Hi

We use a new FWF60E with 5.6.2 in one of our branches and except the public IP or the HQ Forti (to establish the VPN) we route everything directly into the VPN tunnel to our HQ. That's working fine since years and also now with the new FWF60E, but we can't reach the Fortiguard servers that way, even all the ports to the tunnel are open.

So we would like to create a Policy Route for the FWF60E for all the local traffic going directly to WAN1 and not passing the VPN, but we fail as well. I've read it's not possible to create a Policy Route for local traffic, so therefore my question, how can we solve this problem we have now with 5.6.2 and the Forti can somehow establish the Fortiguard services? Is it true that the Forti needs a direct connection to the WAN for it? Shouldn't it also work through an existing VPN tunnel to connect the Fortiguard services?

Appreciate any suggestion.

Thx

Wayne

[oheigl]

If you want to go directly to the WAN:

Create another default route with a lower priority (higher priority value than the existing route so it's not taking precedence) and define the public IP in the source fields of the services like it's explained here: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-system-administration-54/Advanced/IP%...

If you want to go through the VPN:

Define the source IP of the services to your local private IP address of the FortiGate, then it's routed through the VPN. In the HQ you need to allow the traffic from the branch FGT and forward it with source NAT to the WAN.

For FortiGuard features an example:

config system fortiguard

set source-ip x.x.x.x
end

[Wayne11]

oheigl wrote:

If you want to go directly to the WAN:

Create another default route with a lower priority (higher priority value than the existing route so it's not taking precedence) and define the public IP in the source fields of the services like it's explained here: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-system-administration-54/Advanced/IP%...

It's not working that way, we have tried with the internal IP or public IP as "source IP" in the fortiguard config, we were never able to reach the Fortiguard services on port 53 nor on 8888.

XXXX-XXXX (fortiguard) # get
port : 53
load-balance-servers: 1
auto-join-forticloud: enable
antispam-force-off : disable
antispam-cache : enable
antispam-cache-ttl : 1800
antispam-cache-mpercent: 2
antispam-license : Contract
antispam-expiration : Mon Aug 31 2020

antispam-timeout : 7
webfilter-force-off : disable
webfilter-cache : enable
webfilter-cache-ttl : 3600
webfilter-license : Contract
webfilter-expiration: Mon Aug 31 2020

webfilter-timeout : 15
sdns-server-ip : "208.91.112.220"
sdns-server-port : 53
source-ip : PUBLIC_IP
source-ip6 : ::
ddns-server-ip : 0.0.0.0
ddns-server-port : 443

Also with an "Internet Service" route with the "Fortinet-FortiGuard" or "Fortinet-Web" we are unable to to establish a connection. The only way we are able to connect to the FortiGuard services is when we move the default route pointing to the WAN interface instead into the tunnel interface. 

We have to analyze the option through the VPN more in detail, but I'm almost 100% sure we have configured it that way and also no success. But could be that it will work now after we had established the initial connection to the support portal and retrieved the license and registration data. We will try as soon as possible.

Thax

[kallbrandt]

Hello,

Have you tried to use a loopback interface?

Add a firewall policy that allows it out via wan, with NAT enabled.

Set loopback as source-IP for the FortiGuard services, add a default route to wan with same distance (10?) and slightly higher priority value then the def route via IPsec.

Add three policy routes from the loopback IP to the three RFC 1918 address spaces, and set them to STOP POLICY ROUTING. (this is IF the networks on the other side of the IPsec-tunnel are RFC 1918, obviously).

Add the last rule from the loopback IP to 0.0.0.0, point it to wan, don't add an IP, 0.0.0.0 is fine.

NO guarantee it will work with a loopback, good luck. :)