Hi,
I have two routers serving a lot of EIGRP neighbors and are neighbors together. I have to use a Fortigate device between two routers and prefer to configure it in NAT mode. Putting the Fortigate in between, the EIGRP neighborship breaks and the dynamic routing protocol fails even if I set any any allow rule between two points. As a matter of fact, somehow it is not possible to use different IP sets at both sides and fire up the routing protocol. So, what are my choices?
Do static routing?
configure the firewall in transparent mode?
do any special config to make the EIGRP protocol work in this way?
Any help is appreciated
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I used a transparent VDOM, a little challenges but done !
Without having much knowledge about EIGRP, the first thing came to my mind is a tunnel like GRE or IPSec between them through the FGT, then you can use a single subnet for neighboring.
Then when I looked up "EIGRP multihop" on the internet, I found a bunch of documentation with "EIGRP OTP(over the top)" like below:
https://www.packet-forwarding.net/2014/10/09/eigrp-otp-example/
The concept seems to be similar to setting up a tunnel but originally designed to use BGP over the internet as underlying protocol. But seems to work even without it as long as both ends can reach each other like in the above article.
In any case, it's about how to set up Cisco routers at both ends so it's much proper to ask it at Cisco Community instead for this option.
Toshi
If you tunnel via GRE or anything, traffic will not be examined and no security policy works. I already tested it to make sure and was right and it should be this way.
BGP, OSPF and route redistribution is a choice but complex to implement and tshoot.
I will ask in Cisco forums but the first answer is routing protocols redistribution and static routing. I'm asking here because maybe something like Wire Pair or Multicasting or transparent mode is an option ...
EIGRP OTP ... I should read about it
Transparent mode should always be an option. I never used it before so I let someone else to comment.
Toshi
I used a transparent VDOM, a little challenges but done !
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.