FortiGate routing through device instead of gateway

[fvazquez]

Hello, everyone.

We have a client with quite a messy layer 2 topology. We've been trying to deploy a SSL VPN on an internet facing interface (port13) but we've noticed there is a lot of asymmetric traffic and we are not even able to establish a GUI session on the public IP of such interface. Running some troubleshooting commands my team and I noticed that some traffic is coming from an interface (port13) but exiting through another one (port1). Running a traceroute with port13 as a source device we have noticed that the traffic is able to reach its default gateway (through port13) in just one hop and not flowing through port1. 

Is there a way to configure a static route to only accept a device as the outgoing method and not considering an IP as a gateway. I've tried to configure its static route without declaring the gateway IP but it's still not working.

Thanks a lot!

[FractalSphere]

I think I'm understanding what you're aiming at here..

In your SSL-VPN portals you should add some address objects you create with subnets that the SSL-VPN traffic is allowed to access as its destinations. And on the policy itself allowing the SSL-VPN traffic, you could add destination objects to those subnets and the To field to be only the interface that you want traffic to traverse out of.

from (sslvpn) to (internal or whatever appropriate port) source (sslvpn security groups) destination (subnets defined)

[fvazquez]

Hi @FractalSphere 

Yes. That's the main goal, but before configuring the SSL VPN portal we tried to reach the public IP configuring HTTPS protocols in the administrative access but we are not able to reach it from the outside, since requests are coming to the FortiGate through port13 and going out through port1. This is without any VPN configuration.

So, I was looking for a way to force the static route to answer any incoming traffic on that device (port13) rather than having the FortiGate look for the gateway IP and re routing it through port1. Client's network is handling asymmetric traffic, it is configured in the FortiGate and that is why we believe that is the reason sessions are not being stablished properly.

[FractalSphere]

We had this issue at one of our sites, asymmetric routing is rough.  I believe this was required to resolve it. Make sure your static routes are weighted correctly and have proper administrative distance. 

config system settings
    set asymroute enable
end

[fvazquez]

Yes. Asymmetric routing is configured as said in FortiGate and the proper priorities and administrative distances in the static routes for port1 and port13 are well defined. We've even been playing with each one making one less weight but neither configuration works. It still routes outgoing traffic through port1

[Durga_Ashwath]

Hello FractalSphere,

It is because of asymmetric routing, where traffic flows into the FortiGate device on one interface (port13) but exits through another interface (port1), causing issues with SSL VPN connectivity and other traffic flows. To address this, you can configure policy-based routing (PBR) on the FortiGate device to control the egress path of traffic based on specific criteria.

Here's how you can configure policy-based routing on FortiGate to ensure that traffic sourced from a specific interface (port13) always exits through a desired interface (port1):

1. Determine the source IP addresses or subnets for the SSL VPN clients . This will help you define the traffic that needs to be routed in a specific way.

2. Create a policy-based routing rule to match traffic sourced from the SSL VPN interface (port13) and specify the outgoing interface (port1). This will ensure that traffic from SSL VPN clients follows the desired egress path.

   Here's an example configuration using the FortiGate CLI:

   config router policy edit 1 set srcintf "port13" // SSL VPN interface set dstintf "port1" // Outgoing interface set srcaddr "SSL_VPN_Client_Subnet" // Source IP addresses or subnets set action accept set routing-type pbr set pbr-out-interface "port1" // Specify the outgoing interface next end
   3. Once the PBR rule is configured, apply the changes and monitor the traffic flow to ensure that SSL VPN traffic is now routed correctly through the desired interface.Test the SSL VPN connectivity and verify that traffic sourced from the SSL VPN interface (port13) is now exiting through the specified interface (port1).

[fvazquez]

Hi, @Durga_Ashwath . 

Thanks for your reply. Aside from the VPN configurations we are looking for FortiGate to handle incoming traffic on port13 and routing it through the same interface rather than having it being re routed to port1, which is the device's default static route. Is it safe to configure such PBR with these parameters?:

• Incoming interface: port13
• Source address: 0.0.0.0/0.0.0.0
• Destination address: 0.0.0.0/0.0.0.0
• Outgoing interface: port13
• NO GATEWAY ADDRESS

If so, we'll suggest that to the client, since changes need be approved.

Thanks!