Configuring the DHCP relay agent in a VPN tunnel ipsec Site to Site between two networks

[Cleyton]

I created a route-based ipsec VPN connection (as per https://cookbook.fortinet...pn-two-fortigates-56/) to allow transparent communication between two networks that are located behind two Different FortiGates.

80E FORTIGATE v6.0.4 50E FORTIGATE v6.0.4

Fortigate 80E (HQ) establish an ipsec connection with 50E (Branch). Fortigate 80E WAN 189.XX.XX.XX Lan 192.168.254.109

HQ internal Network 192.168.254.0/24

DHCP Enabled IP Initial IP End 192.168.254.100 192.168.254.254

config vpn ipsec phase1-interface     edit "hq-to-branch"         set interface "wan1"         set peertype any         set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1         "VPN: hq-to-branch"         set remote-gw 177.XXX.XXX.XXX         set psksecret     next end

config vpn ipsec phase2-interface     edit "hq-to-branch"         set phase1name "hq-to-branch"         set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305         set auto-negotiate enable         "VPN: hq-to-branch"         set src-addr-type name         set dst-addr-type name         set src-name "hq-to-branch_local"         set dst-name "hq-to-branch_remote"     next end

--------------------------------//---------------------------------------------

FortiGate 50E (Branch) establish an ipsec connection with 80E (HQ). WAN 177.XXX.XXX.XXX LAN 192.168.100.101

DHCP Disabled

Branch Internal Network 192.168.100.0/24

config vpn ipsec phase1-interface     edit "branch-to-hq"         set interface "wan1"         set peertype any         set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1         "VPN: branch-to-hq"         set remote-gw 189.XX.XX.XX         psksecret set ENC     next end

config vpn ipsec phase2-interface     edit "branch-to-hq"         set phase1name "branch-to-hq"         set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305         set auto-negotiate enable         "VPN: branch-to-hq"         set src-addr-type name         set dst-addr-type name         set src-name "branch-to-hq_local"         set dst-name "branch-to-hq_remote"     next end

Users on the HQ's internal network can access resources in the branch's internal network and vice versa. But I want the HQ DHCP to assign ip addresses to the branch network that is in another subnet. Would it be possible?

[Cleyton]

Jirka

I configured my DHCP scopo on Windows according to your scenario, but the branch office does not receive ip from DHCP from headquarters. I do not know what I'm doing wrong, VPN IPsec between fortigate connect perfectly. In Static Routes I set up so that all branch traffic is sent to seat 0.0.0.0/0. When creating the scopo in DHCP, is it necessary to do some additional configuration? Do I have to put the DHCP server's IP address in the branch network interface in DHCP Relay? Do I have to configure any static route in the branch for DHCP Relay to work? see screen capture.

 

[Jirka1]

Hi,

If you have an ipsec with a default routing of 0.0.0.0/0, does it work at the Internet-site through FortiGate at HQ?

My route configuration is:

config router static

    edit 1
        set status enable
        set dst 0.0.0.0 0.0.0.0
        set gateway 193.86.xxx.xxx
        set distance 10
        set weight 0
        set priority 0
        set device "wan1"
        set comment ''
        set blackhole disable
        set dynamic-gateway disable
        set virtual-wan-link disable
        set dstaddr ''
        unset internet-service
        set internet-service-custom ''
        set link-monitor-exempt disable
        set bfd disable
    next
    edit 2
        set status enable
        set dst 0.0.0.0 0.0.0.0
        set distance 10
        set weight 0
        set priority 20
        set device "IPsec-HQ"
        set comment ''
        set blackhole disable
        set dynamic-gateway disable
        set dstaddr "0.0.0.0/0"
        set link-monitor-exempt disable
        set bfd disable
    next
    edit 3
        set status enable
        set dst 0.0.0.0 0.0.0.0
        set distance 254
        set weight 0
        set priority 0
        set comment ''
        set blackhole enable
        set dstaddr "0.0.0.0/0"
        set link-monitor-exempt disable
        set vrf 0
    next
    edit 4
        set status enable
        set dst 172.16.1.0 255.255.255.248 (firts DHCP server)
        set distance 10
        set weight 0
        set priority 9
        set device "IPsec-HQ"
        set comment ''
        set blackhole disable
        set dynamic-gateway disable
        set virtual-wan-link disable
        set link-monitor-exempt disable
        set bfd disable
    next
    edit 5
        set status enable
        set dst 172.27.1.0 255.255.255.248 (second DHCP server)
        set distance 10
        set weight 0
        set priority 9
        set device "IPsec-HQ"
        set comment ''
        set blackhole disable
        set dynamic-gateway disable
        set virtual-wan-link disable
        set link-monitor-exempt disable
        set bfd disable
--More-- next
end

Policy Routing (I need to use it because I have other networks behind FGT on the branch that I NATed directly into WAN.

edit 1
        set input-device "Branch-LAN"
        set srcaddr "172.17.5.0/24l"
        set src-negate disable
        set dstaddr "all"
        set dst-negate disable
        set action permit
        set protocol 0
        set gateway 0.0.0.0
        set output-device "IPsec-HQ"
        set tos 0x00
        set tos-mask 0x00
        set status enable
        set comments ''
    next
end

And DHCP Relay on LAN interface:

config system interface
    edit "Branch-LAN"
        set vdom "root"
        set vrf 0
        set mode static
        set dhcp-relay-service enable
        set ip 172.17.5.1 255.255.255.0
        set dhcp-relay-ip "172.16.1.2" "172.27.1.2" 
        set dhcp-relay-type regular

Also, Policy must be set correctly.

[Cleyton]

[style="vertical-align: inherit;"][style="vertical-align: inherit;"]Caro Jirka[/style][/style]

[style="vertical-align: inherit;"][style="vertical-align: inherit;"]Sou muito grato pela ajuda, executo os procedimentos indicados e funciona perfeitamente. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Mas estou tentando direcionar todo o tráfego de Internet da filial para o túnel VPN e deixado pela WAN do HQ, é possível realizar essa configuração? [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Eu tentei várias rotas estáticas e rotas através da política, e consegui. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]O seu cenário é assim? [/style][style="vertical-align: inherit;"]todo o tráfego da Internet proveniente de suas filiais passa pelo túnel?[/style][/style]