Fortigate static route on the GRE over IPSEC

[SprinteR]

Hello, We have configured several VPN tunnels between our HQ and Branches. In configuration we see that our Branches WAN IP address is recognized be our Fortigate as a Static Route directed to IPSEC interface. Is it normal behavior and if it is possible to change it?

FortiGate 

[spoojary]

Yes, it's normal for firewalls like Fortigate to automatically set up static routes for VPN tunnels based on the WAN IP addresses of your branches. This ensures traffic is properly encrypted and sent through the VPN. You can usually modify or override these routes through your firewall's management interface, but be cautious as changes can affect network connectivity.

[SprinteR]

@spoojary  Hi, thanks for the reply. But I tried to set up one office via a static route towards the WAN. Yes, it overwritten the route, but the connection is lost. Tunnel UP, but traffic stops going.

[spoojary]

check the ad distance between wan and ipsec as well as priority on the static route. make it the same and try.

[SprinteR]

@spoojary  I checked, with the same metrics, recursive routing is obtained and the route in the WAN does not always win. 

[SprinteR]

@spoojary Hi, any other ideas? Or workaround solutions ? The task is simple, it is impossible to check the internet channel by zabbix, because it is blocked by tunnel static.

[SprinteR · Accepted solution]

Hi all, the issue has been resolved with the help of PBR.