Help with access to remote site tunnel VLAN

[Gypsy_Dave]

Hi guys,

I have a remote site connection setup from home to the office via two FG's. Home has FG30D, Office FG80E.

The office has two VLANS. VALN1 and VLAN2 but I can only access VLAN1 and not VLAN2.

I've checked the rules on the office FG and I have the following policy setup on the office FG.

Incoming interface: Tunnel interface

Outgoing is: LAN interface

Source: is my home IP subnet

destination: VLAN1 and VLAN2 ( entries are created on ANY interface)

I've also tried adding another rule which allows Tunnel interface to VLAN2 interface. Still not luck reaching VLAN2.

Any ideas?

Thanks.

[Toshi_Esumi]

Likely the second phase2/selector is not up. Check with CLI "get vpn ipsec tun sum". Looke for "selectors(total,up): 2/?" If both are up it should be "2/2". My guess is you got only "2/1". Then troubleshoot why the second one doesn't come up.

[Dave_Hall]

Is there a route to VLAN2?

[Gypsy_Dave]

Thanks for the replies.

So from the home FG at home I see:

‘Home-to-Studio' x.x.x.x:xxxx  selectors(total,up): 1/1  rx(pkt,err): 4674454/19  tx(pkt,err): 3463619/18

From the work FG I see:

'BackupStudio' x.x.x.x:xxxxx  selectors(total,up): 1/1  rx(pkt,err): 3450186/0  tx(pkt,err): 4684918/90

I did not setup the tunnel only trying to troubleshoot it. So from what I see its been setup as a one wy tunnel? Do I need to create another part to it? Or create the route as mentioned? 

Cheers,

[Dave_Hall]

Check the routing monitor on both fgts. 

On the home fgt the route for VAN2 to be directed out the VPN tunnel (assuming there is one).

On the office fgt there should be a route for LAN2 and/or a firewall policy from the VPN tunnel to VLAN2.

[Gypsy_Dave]

Dave Hall wrote:

Check the routing monitor on both fgts. 

On the home fgt the route for VAN2 to be directed out the VPN tunnel (assuming there is one).

On the office fgt there should be a route for LAN2 and/or a firewall policy from the VPN tunnel to VLAN2.

right getting closer to solving this.

FG home has a route setups follows:

routing monitor show VPN is up. 

 Site to Site - FortiGate

Phase 1 Interface

Dead Peer Detection: on-demand

Local Address Group

Allow this object in routing table: enable

Remote Address Group

Allow this object in routing table: enable

Phase 2 Interface

Destination Address Type: namePerfect Forward Secrecy (PFS): enableSource Address Type: name

Static Route

Enable: 

Blackhole Route

Distance: 254Blackhole: enable

Local to Remote Policy

Action: acceptServices: ALLSchedule: always

Remote to Local Policy

Action: acceptServices: ALLSchedule: always

LAN to TUNNEL:

type: named address

destination: group with IPs for local subnets for VLAN1 and VLAN2 of office networks.

Adminsitrative distance: 10

IP policy rule for LAN TO TUNNEL:

incoming interface: LAN

Outgoing Interface: VPN tunnel interface

Source: all

Destination: group for VLAN1 VLAN2 office subnets.

Service: all

FG office has a route setups follows:

routing monitor show VPN is up. 

LAN to TUNNEL:

type: named address

destination: group with IPs for local subnets for VLAN1 of home network

Adminsitrative distance: 10

IP policy rule for LAN TO TUNNEL:

incoming interface: VLAN7

Outgoing Interface: VPN tunnel interface

Source: all

Destination: local subnet for home network.

Service: all

[Toshi_Esumi]

So you've chosen the source/local address type for phase2 selector as "name" but didn't specify the name? I thought it wouldn't be possible in GUI.

[Gypsy_Dave]

Its got to be some problem with the routing because from HOME to WORK I can reach VLAN1 no problems. Its just VLAN2 I can't reach. 

[sw2090]

II think your outgoiing interface is wrong.

On a FGT each vlan is a virtual interface. So at office FGTyou have to have a policy that has those as outgoing interface.

Also you have to have a corresponding policy on tjhe home fgt:

incoming iface: the port where yourhome lan is

outgoing iface: the tunnel to office

source: your home lan

destination: vlan1 and vlan2 subnets

Additionally the home FGT must have a static route for each vlan subnet you need to access at office!

[Gypsy_Dave]

Right guys cracked it. Many thanks for all your help. The problem was I was going crazy as there was actually two different tunnels setup.

So I concentrated on the HOME to WORK tunnel only and found the IP policy on the work FG, from home tunnel interface to VLAN2 did not have the destination marked as ALL. The interfaces were good but destination was marked as only VLAN2. I changed this to all and I now have access two this vlan from home.

Cheers,