IPSEC VPN VLAN

[sunny007]

Hi have an issue of with setting up an IPSEC VPN between two site.  WAN to WAN it works fine but LAN to LAN we have an issue. Config file removed

[sw2090 · Accepted solution]

basically:

once you have a vpn tunnel (e.g. IPSEC) set up, the rest is definied by policies and routing.

So if you want user from network A to acces network B throuogh your VPN Tunnel you need:

a route on the FGT which the user in network A uses as default gateway which goes to network B with the Tunnel as interface

a route on the FGT which is the default gateway for network B which goes to network A with the Tunnel as interface.

And then both sides need policies to allow the traffic....

[Toshi_Esumi]

I'm not sure what you mean by "wan to wan works". But looks like you have a number of subnet behind the device with 192.168.51.2/30 (FGT has .1/30). Unless you put all of those in "pltotr" address group, they won't be able to reach the other side. Currently the phase2 selector has only the /30 in.

[ede_pfau]

@sunny007:

PLEASE do not post a complete config file with tons of sensitive data! If you can, edit your post and delete the attachment. If you need to post config info, post snippets and change all sensitive data like public IPs, passwords etc.

[sw2090 · Accepted solution]

basically:

once you have a vpn tunnel (e.g. IPSEC) set up, the rest is definied by policies and routing.

So if you want user from network A to acces network B throuogh your VPN Tunnel you need:

a route on the FGT which the user in network A uses as default gateway which goes to network B with the Tunnel as interface

a route on the FGT which is the default gateway for network B which goes to network A with the Tunnel as interface.

And then both sides need policies to allow the traffic....

[ede_pfau]

@sw2090

Actually, you don't need to point your default route to the tunnel (interface), a simple static route for the remote subnet will suffice. The default route handles the remote FGT's WAN interface as well which is NOT reachable through the tunnel - you need to access it via WAN port.

But I'm sure you meant that.

Besides routing, one needs to

- have all remote subnets in the phase2 quick mode selectors

- have all remote subnets in the address fields of the tunnel-to-LAN/LAN-to-tunnel policies.

[sw2090 · Accepted solution]

hmm

I almost never define any subnet but 0.0.0.0/0.0.0.0 in phase2 selectors.

With that you jsut need routing and policies to reach subnets over the vpn.

And I didn't write anything about default routes. I just wrote that if the corresponding Fortigate on each side of the tunnel then it has to do the routing (and policies) for traffic over the tunnel.

[ede_pfau]

a route on the FGT which the user in network A uses as default gateway which goes to network B with the Tunnel as interface

In my view that is a default route. As long as there are no other, more specific routes, all traffic will follow it down the tunnel. Which is not desireable. If you leave out the "default" then it's just a route, and it'll work as planned.

Anyway, I just want to be precise here as others with less experience may find this post and follow it.

One more note: the '0.0.0.0/0' address in a phase2 quick mode selector is AFAIK a FortiOS speciality, it's a wildcard notation. As long as the other side is a FGT as well, it'll work. But not against a Cisco, Juniper or what else. Not very stringent though, you can't use it e.g. as an address wildcard in a policy.

[emnoc]

One more note: the '0.0.0.0/0' address in a phase2 quick mode selector is AFAIK a FortiOS speciality, it's a wildcard notation. As long as the other side is a FGT as well, it'll work. But not against a Cisco, Juniper or what else. Not very stringent though, you can't use it e.g. as an address wildcard i

Correction;

It will work with a cisco , juniper, forcepoint, and a few others ...... In cisco if you do VTI you can use  quad 0s, same  for route-base in JunOS and Forcepoint  based firewalls. Just that I would point that out ;)

Ken

[ede_pfau]

Thanks Ken,

for sharing your experience with 3rd party vendors which I lack. I thought this was a big caveat a while ago but if this is indeed working, all the better!

I always appreciate learning from you.