Layer 2 VPN is that possible?

[jobs2me]

Hello guys, I' m trying to do a IPsec Layer 2 VPN on a Fortigate 110C, the firmware version is v4.0,build0646,121119 (MR3 Patch 11). I have 2 datacenters connected via fiber (VLAN switch to switch from same ISP). Needed to create redundand outside VPN link fortigate-fortigate. The problem is that both datacenters have same /22 subnet (one datacenter was split). As I suppose it should be layer 2 VPN with broadcasts and arp-path through. Can it be done at all with Fortigate units? Thanks.

[Rick_H]

Welcome to the forums! It sounds like you want to extend an entire segment across a VPN link, which would allow all segment traffic--including broadcasts--to cross the tunnel. I might be showing some ignorance here, but I don' t think this can be done with any VPN equipment because IPSec is inherently a layer 3 protocol. You might be able to throw in some other piece of gear on top of the tunnel to accomplish this, but even then I think you' re begging for problems especially when it comes to broadcasts unless you have a really fat internet connection. Assuming the equipment in your DC is using static addresses and the addresses are laid out in a logical way (not intermingled between DCs) I would use NAT instead. You can use Virtual IP to map entire ranges to entire other ranges. This may require you to make some DNS-related changes, but it would keep you from having to re-address one of your DCs. Cheers, Rick

[emnoc]

agreed Re-engineer your design to accomplish your goal vrs try to hack things together. A /22 is 4 class C worth of space, maybe split that into 2 /23s and have a west and east appearance. That would be smarter and overall simpler to deploy and manage. When you start carrying layer2 broadcast and other layer2 traffic between DCs, that could spell disaster.

[Carl_Wallmark]

All other big vendors can do this, and there is a way to do this on a fortigate as well, but it is far from perfect, The keyword here is " proxy-arp" and you are limited to 200 IPs, and you need to specify them all manually. And yes, you should avoid layer 2, BUT there are some scenarios were you want layer 2, I requested this feature a long time ago, but nothing happened.

[jobs2me]

Thanks guys. May be some kind of VLAN via IPSec or GRE? The purpose of that solution is backup only (if fiber will fail for some reason to continue DCs data exchange). It happens very rare but happens. There are much servers with static IPs from different subnets (if split /22 into /24). It will be problem to reconfigure 1 of DCs. Thanks again. P.S. NAT was the first idea and its documented in FortiGate CookBook. Thought maybe there is another way. Rick H is absolutely right: " want to extend an entire segment across a VPN link, which would allow all segment traffic--including broadcasts--to cross the tunnel" broadcasts - only ARP

[Carl_Wallmark]

No, no vlans, Configure a ipsec tunnel in interface mode, With 0.0.0.0 as source and destination. Then you configure proxy-arp on the tunnel interface with the IPs on the other side

[emnoc]

so you tell us that 0.0.0.0/0 as src/dst and proxy-arps will handle l3 broadcats for discovery items? i.e netbios lookups? dhcp ? and

All other big vendors can do this, and there is a way to do this on a fortigate as well, but it is far from perfect,

Who' s a big vendor that can do this ? Cisco ? Juniper ? and carry l2 network across a layer3 vpn-ipsec

[Carl_Wallmark]

so you tell us that 0.0.0.0/0 as src/dst and proxy-arps will handle l3 broadcats for discovery items? i.e netbios lookups? dhcp ?

No, that will probably not work, it will only work with IP to IP, for example: Site1 192.168.1.0/24 -------FG_tunnel---------Site2 192.168.1.0/24 If 192.168.1.1 is on site 1 and 192.168.1.2 is on site 2. These IP´s can talk to each other without NAT between them. If you configure proxy-arp. For example, Cisco has the " pseudowire" in L2TPV3 which will allow a full L2 network over IPSEC. Juniper has the ability as well. Hell, even OPENVPN can do this. (http://i2p.net.in.tum.de/)

[emnoc]

For example, Cisco has the " pseudowire" in L2TPV3 which will allow a full L2 network over IPSEC. Juniper has

But pseudowire is not ipsec & has nothing todo with IPSEC, so that' s why I had to challenge that statement that you made by major " Vendors" , and I can' t speak on SRX but a MX probably will not let you do pseudowire over a ipsec, and the same for a cisco ASA. So that rules out them 2 as major Vendors I would like to see some one with an actual working config of a L2VPNv3 or even MPLS over a ipsec tunnel. It would be interesting if not for alot of over head and pMTU/MSS issues. btw, some one has a proposal/patent out for L2VPN encryption iirc. But I' m not sure if any pseudowire are using ipsec from a practical concept. FWIW: You can always terminate the L2VPNv3 behind the firewalls and then run that thru, but be advise of the over-head and use mtu or tcp-mss-adjustment to counter the path MTU.

[Carl_Wallmark]

No, psedudowire is not IPSEC, but you can use it together with IPSEC, same as you would with a GRE tunnel. This would allow you to have L2 network between two sites, and the security would come from the IPSEC tunnel. Nevertheless, there is a working solution for them who needs a " real" L2 bridge between sites. Also, I never said Cisco ASA, I only said Cisco.