Allow One IP to Remotely Browse through Site-to-Site

[dholton912]

Hey everyone!

I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p... but am unable to get what I need to work. Any help with this would be greatly appreciated!

[dholton912]

Yes, other devices can still access the other LAN across the S2S tunnel.

[mle2802]

Can you try to assign interface IP for tunnel interface on both end and then use the IP of the other side as a gateway for the policy route? 

[dholton912]

What should the interface IP be at both sides? The public IP of the firewall or something different?

[mle2802]

You can use any internal IP as long as it is not duplicate with any local address on FortiGate. 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IP-address-on-an-IPSec-tunnel-in...

[dholton912]

Does it need to be within the same subnet?

[mle2802]

Same subnet with what? You use such as 192.168.200.1 and 192.168.200.2.

[dholton912]

Alright that has been changed.

[mle2802]

Can you try the command 
dia ip proute match 8.8.8.8 10.0.0.50 interface 6 443 443

This is the syntax # dia ip proute match <destination ip> <source ip> <incoming interface> <proto> <destination port number>

Then you can try to ping again with debug flow again

[dholton912]

I received

command parse error before 'proute'
Command fail. Return code -61

[mle2802]

Then just try to ping with debug flow to see if policy routing hitting now