Hey all,
I'm struggling with something super simple. I'm working through the "Hub and spoke SD-WAN deployment example" in the admin guide, trying to set one up in real life. Some of the configuration elements, specifically the local and remote IPs on the tunnels is throwing me for a loop though.
in the admin guide, on the hub side, (on each tunnel interface) they're using an IP for the hub's tunnel interface IP and then a /24 network for the remote-ip:
config system interface
edit "vpn-isp-a"
set vdom "root"
set ip 10.254.0.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.254.0.254 255.255.255.0
set interface "port2"
next
edit "vpn-isp-b"
set vdom "root"
set ip 10.254.1.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.254.1.254 255.255.255.0
set interface "port3"
next
end
But on the spoke side they're using a completely different set of IPs on each tunnel interface, with a /32 for the remote-ip:
config system interface
edit "vpn_dc1-1"
set vdom "root"
set ip 10.255.0.2 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.255.0.1 255.255.255.255
set interface "port2"
next
edit "vpn_dc1-2"
set vdom "root"
set ip 10.255.1.2 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.255.1.1 255.255.255.255
set interface "port3"
next
end
Can someone explain to me how this works?
Thanks in advance!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
If your hub and majority of spokes will eventually have dual WANs then keep the hub with two tunnel interfaces in separate subnets. Just tie them to WAN1 for now.
I would also keep it simple and just map WAN1 tunnel to remote WAN1 tunnel and WAN2 tunnel to remote WAN2 tunnel.
Hi,
I'm interested with this topic.
At first, I have 1 hub and 1 spoke with IP as below:
Hub local IP: 10.90.0.1/32
Hub remote IP: 10.90.1.254/23
Spoke1 local IP: 10.90.0.2/32
Spoke1 remote IP: 10.90.0.1/23
From hub can ping to spoke1 local IP. When I add new spoke, both spoke1 and spoke2 local IP can't be pinged from hub.
Spoke2 local IP: 10.90.0.3/32
Spoke2 remote IP: 10.90.0.1/23
Then I tried to change the spoke remote IP to become /32 as below:
Spoke1 local IP: 10.90.0.2/32
Spoke1 remote IP: 10.90.0.1/32
Spoke2 local IP: 10.90.0.3/32
Spoke2 remote IP: 10.90.0.1/32
But still the hub can't ping to spoke1 and spoke2 local IP.
If 1 spoke is disconnected, then the hub can ping the 1 remaining spoke.
Why does the hub can't ping to spoke local IP when there are more than 1 spokes active?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.