MPLS and Fortigate

[sushil]

Hi, A customer of ours is running MPLS among the offices.Now a fortigate had to be deployed there. Present setup is on cisco router terminating MPLS.So on Site A connection from MPLS router say (192.168.1.1/24 on int of Router) is coming towards Switch of Internal Lan and communication happens with site B as it has to be. There comes new Router for Internet purpose on SiteA as internet traffic has to leave from here. I can think of it as follows on siteA. 1.Internet link from internet Router goes to Fortigate on Say Wan1. And IP Is X.X1.X2.X3. 2. The cable from MPLS router (which was leading to switch with ip 192.168.1.1) needs to be terminated on Fortigate now on Port2 with IP on same subnet say 192.168.1.2. 3. A new Interface Port2 (meant for internal LAN) has to be used and preferablly with diffirent subnet say 192.168.2.0/24 (as you can' t have same subnet on diffirent interface) and goes into Switch. Now create a Nat rule b/w Port2 and Wan1 for Internet connection from internal to Wan and assocaited default route all to internet. I need to understand how to make MPLS working from Site A.As traffic from Port2 to port1 has to be routed for Site B.Just an un-natted rule will work here?I guess that is required.Will there be any routing needs to be done to make the traffic understand to go to MPLS router for this traffic? 2nd Question is how to make internet working for site B via MPLS say having the subnet 192.168.100.0/24 on siteB.I understand that all traffic will leave from SiteB towards site A over MPLS and recieved on port2 on Fortigate at SiteA.How would Fortigate on SiteA will understand which traffic to be sent to Internet on which one to internal network? Reg, Sushil

[wraezor]

You will need two routes: 1) Internet router IP as default gateway (may be automatic depending on WAN ip setup). 2) MPLS router IP as next hop to Site B subnet (static route). Everything else will be directly connected so routes will be automatically created. Once you have the routes in place, the firewall policies are simple. Outbound Internet traffic will require the following firewall policies: 1) Src: Site A, Dst: Internet, NAT enabled. 2) Src: Site B, Dst: Internet, NAT enabled. Site-to-Site traffic will require the following firewall policies: 1) Src: Site A, Dst: Site B, NAT disabled. 2) Src: Site B, Dst: Site A, NAT disabled. Limit protocols and addresses as you see fit.

[sushil]

Thanks for your response. What if both sites having FG and need to run IPSEC with lower priority than MPLS. Which device need to send ping and keep probing in case of failure of MPLS link. How to impliment S-2-S IPSEC for redundacy.How will config look like. Reg, Sushil