Hello, everyone.
We have a client with quite a messy layer 2 topology. We've been trying to deploy a SSL VPN on an internet facing interface (port13) but we've noticed there is a lot of asymmetric traffic and we are not even able to establish a GUI session on the public IP of such interface. Running some troubleshooting commands my team and I noticed that some traffic is coming from an interface (port13) but exiting through another one (port1). Running a traceroute with port13 as a source device we have noticed that the traffic is able to reach its default gateway (through port13) in just one hop and not flowing through port1.
Is there a way to configure a static route to only accept a device as the outgoing method and not considering an IP as a gateway. I've tried to configure its static route without declaring the gateway IP but it's still not working.
Thanks a lot!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I think I'm understanding what you're aiming at here..
In your SSL-VPN portals you should add some address objects you create with subnets that the SSL-VPN traffic is allowed to access as its destinations. And on the policy itself allowing the SSL-VPN traffic, you could add destination objects to those subnets and the To field to be only the interface that you want traffic to traverse out of.
from (sslvpn) to (internal or whatever appropriate port) source (sslvpn security groups) destination (subnets defined)
Yes. That's the main goal, but before configuring the SSL VPN portal we tried to reach the public IP configuring HTTPS protocols in the administrative access but we are not able to reach it from the outside, since requests are coming to the FortiGate through port13 and going out through port1. This is without any VPN configuration.
So, I was looking for a way to force the static route to answer any incoming traffic on that device (port13) rather than having the FortiGate look for the gateway IP and re routing it through port1. Client's network is handling asymmetric traffic, it is configured in the FortiGate and that is why we believe that is the reason sessions are not being stablished properly.
We had this issue at one of our sites, asymmetric routing is rough. I believe this was required to resolve it. Make sure your static routes are weighted correctly and have proper administrative distance.
config system settings
set asymroute enable
end
Yes. Asymmetric routing is configured as said in FortiGate and the proper priorities and administrative distances in the static routes for port1 and port13 are well defined. We've even been playing with each one making one less weight but neither configuration works. It still routes outgoing traffic through port1
Hello FractalSphere,
It is because of asymmetric routing, where traffic flows into the FortiGate device on one interface (port13) but exits through another interface (port1), causing issues with SSL VPN connectivity and other traffic flows. To address this, you can configure policy-based routing (PBR) on the FortiGate device to control the egress path of traffic based on specific criteria.
Here's how you can configure policy-based routing on FortiGate to ensure that traffic sourced from a specific interface (port13) always exits through a desired interface (port1):
Determine the source IP addresses or subnets for the SSL VPN clients . This will help you define the traffic that needs to be routed in a specific way.
Create a policy-based routing rule to match traffic sourced from the SSL VPN interface (port13) and specify the outgoing interface (port1). This will ensure that traffic from SSL VPN clients follows the desired egress path.
Here's an example configuration using the FortiGate CLI:
config router policy
edit 1
set srcintf "port13" // SSL VPN interface
set dstintf "port1" // Outgoing interface
set srcaddr "SSL_VPN_Client_Subnet" // Source IP addresses or subnets
set action accept
set routing-type pbr
set pbr-out-interface "port1" // Specify the outgoing interface
next
end
Hi, @Durga_Ashwath .
Thanks for your reply. Aside from the VPN configurations we are looking for FortiGate to handle incoming traffic on port13 and routing it through the same interface rather than having it being re routed to port1, which is the device's default static route. Is it safe to configure such PBR with these parameters?:
If so, we'll suggest that to the client, since changes need be approved.
Thanks!
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1634 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.