Hello, We have configured several VPN tunnels between our HQ and Branches. In configuration we see that our Branches WAN IP address is recognized be our Fortigate as a Static Route directed to IPSEC interface. Is it normal behavior and if it is possible to change it?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi all, the issue has been resolved with the help of PBR.
Yes, it's normal for firewalls like Fortigate to automatically set up static routes for VPN tunnels based on the WAN IP addresses of your branches. This ensures traffic is properly encrypted and sent through the VPN. You can usually modify or override these routes through your firewall's management interface, but be cautious as changes can affect network connectivity.
@spoojary Hi, thanks for the reply. But I tried to set up one office via a static route towards the WAN. Yes, it overwritten the route, but the connection is lost. Tunnel UP, but traffic stops going.
check the ad distance between wan and ipsec as well as priority on the static route. make it the same and try.
@spoojary I checked, with the same metrics, recursive routing is obtained and the route in the WAN does not always win.
@spoojary Hi, any other ideas? Or workaround solutions ? The task is simple, it is impossible to check the internet channel by zabbix, because it is blocked by tunnel static.
Hi all, the issue has been resolved with the help of PBR.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1660 | |
1071 | |
751 | |
443 | |
219 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.