Allow One IP to Remotely Browse through Site-to-Site

[dholton912]

Hey everyone!

I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p... but am unable to get what I need to work. Any help with this would be greatly appreciated!

[mle2802]

Hi @dholton912,

Can you try to run the following command on both FortiGate when ping 8.8.8.8 from 10.0.0.50:

diag sniffer packet any "host 10.0.0.50 and icmp" 4 0 l

[dholton912]

On FW B I get no responses as if the traffic never makes it there. On FW A I get continual 2024-01-08 10:55:34.243037 interface in 10.0.0.50 -> 8.8.8.8: icmp: echo request

[mle2802]

Can you run this on FWA when pinging again

diag debug reset

diag debug flow filter addr 10.0.0.50
diag debug flow filter proto 1
diag debug flow show ip en

diag debug flow show func en

diag debug console time ena

diag debug ena

diag debug flow trace start 999

[dholton912]

Do I run these one at a time or copy the whole and paste into the CLI?

[mle2802]

Yes, you can copy the whole thing and paste in CLI, press enter and run the ping. After the ping complete, copy result and close the CLI

[dholton912]

2024-01-08

[mle2802]

Look like there is traffic is still using wan2. Can you please run the command:

config router policy
show full

[dholton912]

config router policy
edit 1

next
end

[mle2802]

Hi @dholton912,

Instead of using 0.0.0.0, can you try to set the address as "all"

[dholton912]

So I'm on an older firmware and this is my options in the GUI.