Branch fortigate setup advice needed

[Tutek]

Hi,

I would like to connect branch 80f fortgates to main HQ using sd-wan, conditions that must be meet:

1.branch internet is routed back thru HQ fortigate

2.access from internet like wan management and SSL VPN on branch should be possible

3.access to other lan subnets on branch side should be accessible.

Now my concerns:

1. If I create ipsec tunnels between HQ and branch in tunnel mode so remote branch subnet 172.50.1.0/24 will have in ipsec selector destination as 0.0.0.0/0 - then I will not have access to other local subnets on branch side because ipsec steal all traffic and push to HQ.

2.If I create ipsec in interface mode, then I need to create static route with destination like 0.0.0.0/0 and gateway ipsec interface - in this scenario, any incoming connection from internet like remote web management or SSL VPN will be pushed throught ipsec tunnel = no connection.

How could I resolve this issues?

[Tutek]

How should I configure at central fortigate sd-wan rules for internet traffic going back to branch lan?

Do I need create sd-wan rule something like:

Source: 0.0.0.0/0 destination 172.50.1.0/24 using interfaces from sd-wan zone. Or just should I configure static route with destination branch lan 172.50.1.0/24 with gateway sd-wan zone?

Cannot find aby document with configuration branch nad hq when using remote internet access like in my scenario.

[gfleming]

https://docs.fortinet.com/document/fortigate/6.4.11/administration-guide/256748/controlling-traffic-...

[Tutek]

I read this document. I don't use in my network dynamic routing protocols I have only couple subnets that never change, I don't need bgp. Is there any cookbook document to configure sd-wan with RIA and with static routing? I coudn't find it.

[gfleming]

If there are two VPN tunnels (because you have two WAN links) between central FG and remote Branches then you will need to use BGP so that it can choose the one that was used for the inbound connection. If you do not want to run BGP then central FG will just use the route in your routing table that is preferred to send traffic back to branch.

[Tutek]

But I understand concepts of routing, and if I do not have ospf, gbp, rip I have to configure static routes. I am not forced to use dynamic protocols with multi-wan setup like mine, after all, this is what sd-wan was created for.

My question is simple, where and how to configure this route, my problem is understanding when to use sd-wan rules and when static routes to control traffic that passing two ipsec tunnels (sd-wan zone).

On branch I have now sd-wan rule:

1. source local lan (172.50.1.0/24), destination central lan (172.10.1.0/24) goto manual selection ipsec1, ipsec2

2. source local lan (172.50.1.0/24), destination everything-internet (0.0.0.0/0) goto manual selection ipsec2, ipsec1

On static routes I have only one route: destination 0.0.0.0/0 gateway virtual-wan-link (wan1, wan2)

Now on Central (HQ) fortigate, in sd-wan rules I have:

1.local lan 172.10.1.0/24, destination branch lan (172.50.1.0/24) go to manual selection ipsec1, ipsec 2

On static routes I have only 0.0.0.0/0 using virtual-wan-link (wan1, wan2)

And this is my question, where configure now routing for internet that going back to branch, do I need add second sd-wan rule like: source 0.0.0.0/0 --> destination branch lan, use sd-wan zone (ipsec1, ipsec2) or configure system static route like:

destination branch lan -->gateway sd-wan zone (ipsec1, ipsec2)

[gfleming]

Your question is simple but the answer, unfortunately is not. What is the behaviour you want? Do you want the return traffic going back to branch to choose the same ipsec tunnel that it came in on? Or do you want the traffic to go over whatever ipsec tunnel that the central fortigate thinks is best?

Also confirm what version of FOS you are on?

[Tutek]

at the beginning  I would like to make it possible to access the Internet for branch because there is none, and, if possible, to be able to control which interfaces should the traffic move.

Branch 7.2.3, central fortigate 6.4.11 now my problem is that branch can ping ipsec interfaces, and central fortigate can not, all request going not to tunnel but to the internet.

[gfleming]

OK not too sure if you fully answered my question; it sounds like you want to be able to control which interface on central FGT is selected for return traffic back to branch regardless of what interface it came in on. This could result in asymmetric flows. In this case you would create SD-WAN rules for interface selection for traffic going from central to branch.

Most important in this consideration is that different versions of FOS will handle return traffic differently. After 6.2 and later (which you are running) the Auxiliary Sessions are disabled by default. This means the central FGT will choose the interface that the traffic came in on as the return interface, no matter what else is configured.

If you enable auxiliary sessions you can have the central FGT select a different outgoing interface based on SD-WAN rules.

https://docs.fortinet.com/document/fortigate/6.4.4/administration-guide/014295/controlling-return-pa...