Hi!
I am having some issues with this current network design we have.
Main office: IP: 172.25.65.166/24 GW: 172.25.65.165
IP: 172.25.65.166/24 GW: 172.25.65.165
Data Center:
GW: 172.25.65.93 -----> vlan200 172.25.65.94/30 (port1)
The internal LAN on the FortiGate on the DC is 172.16.101.0/24
The FortiGate is in NAT mode.
I set the 172.25.65.0/24 in a static route so it gets out from the port1 using the GW of the DC.
I set the policy to allow the port1 traffic to be able to talk to the LAN with without NAT.
I see that the LAN and the VLAN200 show as connected routes on the Fortigate.
This should the traffic that I am trying to get
Office -----> DC GW -----> Fortigate VLAN 200 --------> Server on the LAN
I can reach my FortiGate on the DC but I can't reach any of the machines that are on the LAN even after I set the policy to allow traffic. Am I doing something wrong or missing something like a route?
Help is much appreciated
Thanks!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
It looks like you are on the same subnet with all those machines.
IP: 172.25.65.166/24 GW: 172.25.65.165
the /24 tells me you are using a 255.255.255.0 which means 172.25.65.1-254 are usable.
172.25.65.93 and 172.25.65.94 are on the same subnet as your main office.
How are the two offices connected? Using MPLS, Layer2, or IPsec tunnel?
Yes, that is correct. I was told by the ISP that they (office and DC) are connected through Layer2 on a separate VLAN, in this case, is the VLAN that is on the port1 of the Fortigate on the DC.
Ditto on what EMES said. You should set both sides to /25 subnets if you are married to the scheme 172.16.25.x. One side would be 172.16.25.0/25 (usable from 1-126, 127 broadcast) and the other side would be 172.16.25.128/25 (usable from 129-254, 255 broadcast). These would be perfectly acceptable and routeable addressing schemes. What you have now needs to be spanned and it won't work across a routed domain.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
@rwpatterson, thanks for answering. Could this bad subnetting be the cause of me not being able to reach the lan? On the routing table on my DC I see 172.16.25.29/30 as a connected route. Would it work if I change my /24 of my office to a /30 too?. Again, thanks for replying.
aespinola wrote:@rwpatterson, thanks for answering. Could this bad subnetting be the cause of me not being able to reach the lan? On the routing table on my DC I see 172.16.25.29/30 as a connected route. Would it work if I change my /24 of my office to a /30 too?. Again, thanks for replying.
172.16.25.29/30? That is merely a transit route in the same subnet as the other two. (Only usable IP addresses are 172.16.25.29 and .30) Why are you trying to use the same subnet scheme over and over? These are private subnets. You literally have thousands to choose from. Open your network, man! Change one side to 172.16.26.0/24 and watch the traffic start flowing.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
rwpatterson wrote:I understand what you mean, the subnets were not chosen by me though, they were given to me by the ISP. They told me to use this subnet here and use this one there. If it was for me I would totally go the way you are saying.aespinola wrote:@rwpatterson, thanks for answering. Could this bad subnetting be the cause of me not being able to reach the lan? On the routing table on my DC I see 172.16.25.29/30 as a connected route. Would it work if I change my /24 of my office to a /30 too?. Again, thanks for replying.
172.16.25.29/30? That is merely a transit route in the same subnet as the other two. (Only usable IP addresses are 172.16.25.29 and .30) Why are you trying to use the same subnet scheme over and over? These are private subnets. You literally have thousands to choose from. Open your network, man! Change one side to 172.16.26.0/24 and watch the traffic start flowing.
I called them about the /24 I was having in the office and they told me it was a mistake and to change it to /30. Now I have /30 on both sides. Gonna check tomorrow if that solves something.
Your ISP sucks. Their only redemption would be if they wanted you to use 172.16.25.29/30 on one side of the VPN link and 172.16.25.30/30 on the other in between the two boxes. If this is a rented span and not going over the Internet, then this would work. You would have to change the IP subnet on both LANs to be two other unique subnets as well for all that to work.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.