Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
dholton912
New Contributor

Allow One IP to Remotely Browse through Site-to-Site

Hey everyone!

 

I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p... but am unable to get what I need to work. Any help with this would be greatly appreciated!

1 Solution
hbac

@dholton912

 

I believe your default route is pointing to wan2 which is why it doesn't match the policy route. You will need another static route and point it to the IPSec tunnel. You can create a static route for 8.8.8.8 for testing and point it to the IPSec tunnel. After that, run the debug flow again. 

 

Regards, 

View solution in original post

52 REPLIES 52
AEK
Honored Contributor

Hello

Did you try with policy route?

AEK
AEK
mpeddalla
Staff
Staff

Hello  @dholton912 ,

 

Thank you for contacting the Fortinet Forum portal.

-You can create a policy route on firewall B with source 10.0.0.50 to destination 0.0.0.0/0.0.0.0 interface should be site to site vpn tunnel.

-On the remote site create a firewall policy or make sure the traffic passes via the wan interface from that source.

article for policy route 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-...

 

 

 

Best regards,

Manasa.

 

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

dholton912

So when creating the policy route, do I create it on FW B or A? 

dholton912

Also how do I prevent 10.0.0.50 from using FW A to get to the internet before passing to FW B?

dholton912

Also, for the policy route on FW B, should the incoming interface be the site-to-site and the outgoing interface be my wan interface or something different?

hbac

Hi @dholton912,

 

Since 10.0.0.50 is behind FW A, you need to create a policy route on FW A and not FW B. On FW B, you need a firewall policy to allow traffic from the IPsec tunnel to the Internet with source=10.0.0.50 if no NAT is involved. 

 

Regards, 

mle2802

Hi @dholton912,

So policy route on FW A with source of 10.0.0.50/32 and destination of 0.0.0.0. On FwB, you will also need policy from tunnel interface to wan with same source as policy route on FWA. 

mle2802

Hi @dholton912,

Also please make sure there is policy from where 10.0.0.50 site to tunnel interface and 10.0.0.50 is included in P2 to allow through the tunnel.

dholton912

So on the FW A, I have a policy route that has the incoming interface set as internal with the source as 10.0.0.50 and the destination as 0.0.0.0/0.0.0.0. The action is set to forward traffic to outgoing interface of site to site VPN and a gateway address of 0.0.0.0. 

 

I have the 10.0.0.50 in the phase 2 of the site-to-site with a destination of 0.0.0.0 and the inverse on the remote FW where internet should pass through. I also have a policy on that FW that allows traffic from the S2S VPN with 10.0.0.50 to access the WAN interface. 

 

The issue I'm still seeing is when 10.0.0.50 goes to access the 10.1.1.0/24 network it is successful. But if I go to access any other IP or URL, the traffic seemingly goes nowhere.

Labels
Top Kudoed Authors