Branch Fortigate use HQ Fortigate as default gateway

[Mark_Oakton]

Hi All, Have brain freeze and can' t remember how to do, thought I' d ask the experts, hoping for some quick help! I have a central Fortigate with UTM services, web filtering. etc. And a remote Fortigate using an IPSEC tunnel to connect to HQ, all users in the remote site need to have their default route go over the VPN - so they can have the same web filtering policies as the HQ network from the HQ firewall. I have IPSEC tunnel configured (interface mode) and can access ranges in both sites but now need to push the default route over the VPN. The Fortinet documentation says to edit the static route to 0.0.0.0 and point it over the tunnel interface but if I do that the remote Firewall won' t have is next hop, default gateway listed anywhere - so won' t be able to reach the external peer ID for the VPN as it will not know how to connect. Am sure I have missed the obvious but its been a long day, any advice very appreciated Regards, Mark

[Istvan_Takacs_FTNT]

Far from being an expert, I' m a newbie here, but why would you change the default route? The way you manage the traffic is by creating FW policies to send the end-users requests into the VPN tunnel and that should deliver them to the HQ. The end-users dgw points at the firewall and it sends the requests via the tunnel to the other end. The only static route might still be required is from the VPN interface to the other side.

[Mark_Oakton]

Hi Istvan, Thanks for the response, agreed the traffic can bve managed by policies but the policy will define the destination interface as the tunnel with destination range any, but there is no route in the layer 3 table to send traffic to any IP through the tunnel, so i am sure something needs to be done with the routing table

[ede_pfau]

I see your problem. A FGT which has it' s default route on the other end of a tunnel cannot establish that tunnel as it won' t know how to connect to it' s ISP. The thing here is that you have to change your clients' default route, not your firewall' s. How-to: Say, the HQ subnet is 192.168.23.0/24, and the HQ' s FGT is 192.168.23.1. You configure your VPN in Interface Mode (what else) such that the remote subnet behind the tunnel is 192.168.23.0/24. The FGTs default route is either statically assigned or by the WAN protocol (PPPoE, DHCP) and points to your ISP' s gateway router. Then the clients: if the FGT is their DHCP server, in the DHCP setup you specify 192.168.23.1 as the default gateway, and let the clients request a lease anew. If your clients use static addressing then you have to insert the default route manually on each client. Now, what happens if the tunnel won' t come up? No problem on a FGT, you would install 2 default routes, one for backup with a slightly higher priority (" cost" ). On a DHCP client, not so easy. You can try to insert a backup default route on each client using " route -p add" but have to check that the metric is higher than that of the DHCP obtained default route. Hope that will do.

[Mark_Oakton]

Hi Ede_pfau, You are 100% correct, the problem is that the FW can' t route to the other end of the tunnel as it cant route to the ISP. I dont think changing gateway or route on clients is going to be possible, also the gateway cant be set outside the local range so unsure how this could work

[netmin]

I would try adding a second default route on the VPN interface pointing to the HQ, with same distance, lower priority (preferred) as the first default route on branch wan interface and add dead gateway detection on the tunnel interface. For branch FGT set it' s source ip for ntp, dns, fortiguard to the wan ip address. If that didn' t work as is, add a more specific route to the HQ external IP via the wan interface. (One can' t have set a clients default gateway outside their local subnet.)

[Mark_Oakton]

Hi netmin, Sure, the gateway cant be set on a different subnet, the second route sounds possible with a different priority, i tried this but with a different distance and lost connectivity - so will try this and let you know Also not sure what you mean by set source for ntp, dns, fortiguard to wan ip, do you mean the local wan? thanks Mark

[Mark_Oakton]

Hi All, This seems to work, I added a secondary route to 0 for the vpn interface, same distance, lower priority (as suggested by netmin) Obviously we need the tunnel to be open, not restricted to range on either end, and also a policy and a route on the central firewall to allow the remote range external access thanks again for all your help Mark (attached images of route settings)

[netmin]

Excellent job The same distance is required to keep both default routes in the routing table (RPF check for traffic arriving on the branch FGT interface), as described here: http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103 The original intention for changing the source-ip for services of the branch FGT to the WAN ip was to have it using this address. If all works now then there appears to be no need.

[FGTuser]

What about setting default route to the tunnel and remote IPSec peer host route (/32) via ISP (instead of default route). I think it should work.