Hello Guys,
i have a strange question:
i have two IPSEC tunnels as below:
branch 01 ----- HQ ------ azure
ip1 -> iphq iphq->ip1
iphq+ip1->ipaz ipaz->iphq+ip1
we can't have any more IPSEC tunnel on brach01 so i'm trying to route the subnet ipaz presented by the tunnel between hq and azure to branch01 and vice versa.
I think i'm missing something in between also i can't nat because we have video traffic that don't like nats.
any ideas?
THX a lot!
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
You should be able to achieve the respective with the following:
1. In HQ, ensure that branch local subnet is included as the local subnet in the Phase2 between the VPN tunnel of HQ - Azure, and the subnet of Azure is included as the local subnet for Phase2 between VPN tunnel of HQ and Branch01
2. Ensure that there is a policy in HQ that allows traffic between IPSec_Branch01 - IPSec_Azure and reverse policy
3. If HQ is able to connect to Branch01 and Azure without any issue, I believe the static route is already in place
4. In Branch01, make sure that remote subnet for Azure is configured in Phase2 selector for the IPSec tunnel between Branch01 and HQ
5. Ensure that Azure remote subnet is included in the firewall policy for local port to IPSec_HQ in Branch01
6. Ensure that Azure firewall is configured to permit traffic as well
If you already have all the above in place and still not able to reach to Azure site from Branch01, I would suggest you run the following commands on all the firewall (if they are all FortiGate) to check what could be the root cause:
diag deb flow filter saddr <source_IP_from_branch>
diag deb flow filter daddr <destination_IP_on_Azure>
diag deb flow sh function-name en
diag deb flow sh iprope en
diag deb flow trace start 20
diag deb en
Then, test the connection from Branch01 user and check how is the traffic being processed.
Hi,
You should be able to achieve the respective with the following:
1. In HQ, ensure that branch local subnet is included as the local subnet in the Phase2 between the VPN tunnel of HQ - Azure, and the subnet of Azure is included as the local subnet for Phase2 between VPN tunnel of HQ and Branch01
2. Ensure that there is a policy in HQ that allows traffic between IPSec_Branch01 - IPSec_Azure and reverse policy
3. If HQ is able to connect to Branch01 and Azure without any issue, I believe the static route is already in place
4. In Branch01, make sure that remote subnet for Azure is configured in Phase2 selector for the IPSec tunnel between Branch01 and HQ
5. Ensure that Azure remote subnet is included in the firewall policy for local port to IPSec_HQ in Branch01
6. Ensure that Azure firewall is configured to permit traffic as well
If you already have all the above in place and still not able to reach to Azure site from Branch01, I would suggest you run the following commands on all the firewall (if they are all FortiGate) to check what could be the root cause:
diag deb flow filter saddr <source_IP_from_branch>
diag deb flow filter daddr <destination_IP_on_Azure>
diag deb flow sh function-name en
diag deb flow sh iprope en
diag deb flow trace start 20
diag deb en
Then, test the connection from Branch01 user and check how is the traffic being processed.
It doesn't suffice to just have 2 routes in place. Each subnet needs to know how to reach the other 2 subnets, and that calls for 2 routes.
in branch:
route to HQ
route to AZ
in HQ:
route to branch
route to AZ
in AZ:
route to HQ
route to branch
As the FGT is not only a router but a firewall, you need to allow those subnets in policies. Just use 2 address objects in the ingress and egress policies, on each FGT.
Of course, everything else in Kayzie's answer is 100% correct and helpful. 'diag debug flow' will show exactly what is going on, if you think that routes and policies are all in place and it still doesn't work.
Hi guys,
Thanks a lot for all the help,
i tried both solutions and it doesn't work. azure side i have all the configuration in place (the tunnel si up and the phase 2 is up and running) azure automatically create the correct route and is identical for the other subnets.
when i execute the debug command i never receive any packets. i also tried reversing the filter to be able to initiate the connectio from azure to branch01. and it seams the firewall in hq doesn't ever receive any packets from azure to branch01 in for that subnet. I did the same tests using the other subnets between azure and HQ and the test show all tha packets.
i'm blaming azure now.
i'll update if i can find a solution azure wise.
thanks again
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.