- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to WiFi at branch office route across tunnel to head office?
I have a branch office that has a point to point vpn with the head office. This link has been operating flawlessly for months now. Clients on either end can communicate with clients on the other end. There is no nat between the sites. Each branch office has it's own subnet. The branch offices are using Fortigate 50E and the head office is using Fortigate 60E. The branch office Fortigates are the type that have build in WiFi, so the fortigate is aware of the subnet for the wifi and acts at the gateway/dhcp/dns for the wifi network. The branch offices have a private wifi that is on it's own unique subnet that is able to reach the wired subnet at it's own branch. However I am unable to have that private wifi reach the head office subnet. There is no nat between the private wifi and the wired network.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are 3 parts to getting this done:
1. Routing - Do the firewalls have a route to get to the wifi network via tunnel
2. ipv4 policy - Is the traffic allowed based on firewall rules interface/source/destination
3. Phase 2 selectors - Does the traffic match the VPN tunnels phase 2
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are 3 parts to getting this done:
1. Routing - Do the firewalls have a route to get to the wifi network via tunnel
2. ipv4 policy - Is the traffic allowed based on firewall rules interface/source/destination
3. Phase 2 selectors - Does the traffic match the VPN tunnels phase 2
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are 3 parts to getting this done:
1. Routing - Do the firewalls have a route to get to the wifi network via tunnel
2. ipv4 policy - Is the traffic allowed based on firewall rules interface/source/destination
3. Phase 2 selectors - Does the traffic match the VPN tunnels phase 2
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the VPN on the remote firewall is set up in policy mode, you'll have to break it and recreate it in interface mode. When that is done, you can assign a route for that traffic to get it away from the default route out the door.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1. I would have assumed that the tunnel (having been setup using the vpn wizard) would automaticly include the remote sites subnets. Certainly that worked for the wired networks. That being said, I did create static routes but didn't see any change. 2. Policies are in place allowing the traffic
So that would be to change the Phase 2 selectors local and remote address's to subnet instead of named address? Can I just add a subnet instead of changing the existing settings?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You may be able to. I never messed with selectors once my tunnels came up. I HAVE added more phase two selectors but if I had a working phase two pair working, it was voluntarily locked out more or less.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So making changes to a working vpn tunnel may not have any effect? I have been trying to add the selectors to both sides but still can't get traffic to pass.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You will also need the corresponding policies present.
VPN tunnel + routes + policies = traffic
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to test each step of this. There are the 3 parts that need to be correct. Actually 6 if I understand correctly because these settings need to be completed on both sides.
Although I think I have everything set, I just can't seem to get it to work.