Multiple Subnets

[Brian_Gibbs]

So here is what I am trying to accomplish

I have site A (HQ) that is connected to site B over an ipsec tunnel. 

Site A has an internal network of 192.100.200.0/24

Site B has an internal network of 192.100.231.0/24

The ipsec tunnel is connected and working correctly. 

At site A a new interface was created with VLAN 10 subnet 10.10.10.0/23 - Site A has full access to this interface

I need to allow Site B access to this new interface.

I have added interface ip to phase2 on the VPN tunnel, created a static route and have created policies but nothing seems to work. I can't get this new interface to pass along the ipsec tunnel. I can't rebuild the tunnel as Site B is in HI. 

Any thoughts?

[sw2090]

All you need is the tunnel (which you already have). You don't need interface ip on phase2.

What you then need on Side B is a static route to 10.10.10.0/23 over your tunnel and a policy that allows 192.100.231.0/24 to access 10.10.10.0/23 over the tunnel.

Side A then needs to have policy to allow traffic comiing from the tunnel with source 192.100.231.0/24 and destination 10.10.10/23 and src interface your tunnel and dest interface your vlan.

That should do the trick. It does here with several vlans in different location.

[Brian_Gibbs]

Thanks for the quick reply. One question. Is this a Route Policy or an IPV4 Policy. 

Sorry really new to the fortigate environment 

[sw2090]

IPv4 Policy

[Brian_Gibbs]

Thanks. Like I said very new. 

So here is what I have. 

Site A: IPV4 Policy

Incoming Interface: Tunnel

Outgoing Interface: VLAN10 (10.10.10.0/23)

Source: all

Destination: 10.10.10.0/23

Schedule: always

Serivice: All

Site B: Static Route

Destination Subnet: 10.10.10.0/23

Interface: VPN TUNNEL

Any help is greatly appreciated. I have about 15 of these that I need to give access to this subnet. 

[Brian_Gibbs]

Quick question. Could i just add the subnet to the already existing IPV4 policy on each side. Along with the static route

[emnoc]

Brian it all depends, If the device termination for siteA/B are fortiagte and the vpn is a route-based using  0.0.0.0/0:0  you only need a route and policy to allow the traffic flow

if you did a unique phase2 with src/dst-subnets   that are NOT 0.0.0.0/0:0 you need a 2nd phase2-tunnel and again a route if it's route-based

I prefer the later since you  get phase2 statistics when you use unique phase2 proxy-ids

e.g

option  A 0.0.0.0/0:

config vpn ipsec phase2-interface     edit "vpn-2-site"         set phase1name "INSERTPHASE1NAME HERE"         set proposal aes128-sha1         set pfs disable         set keepalive enable         set auto-negotiate enable         set keylifeseconds 3600     next end

optionB based on what you provided

config vpn ipsec phase2-interface     edit "exampleB-PH2-1"         set phase1name "INSERTPH1NAMEHERE"         set proposal aes128-sha1         set pfs disable         set keepalive enable         set auto-negotiate enable         set keylifeseconds 3600         set src-subnet 10.10.10.0/23         set dst-subnet 192.100.231.0/24     next config vpn ipsec phase2-interface     edit "EXAMPLEB-PH2-2"         set phase1name "INSERTPH1NAMEHERE"         set proposal aes128-sha1         set pfs disable         set keepalive enable         set auto-negotiate enable         set keylifeseconds 3600         set src-subnet 192.100.200.0/24         set dst-subnet 192.100.231.0/24     next end

Ken Felix

[sw2090]

SIDE A needs:

IPv4 Policy:

Incoming interface tunnel

Outgoing interface vlan10

source 192.168.231.0/24 (all would be overkill here)

destination 10.10.10.0/23

Schedule: allways

Service: all

Status: Accept

Nat: no

As you say the tunnel works I assume you already have a route for 192.168.231.0/24 on Side A :)

You do not need a route vor vlan10 subnet on side a since side a has an interface in that net.

SIDE B needs:

IPv4 Policy:

Incoming interface: the interface whre 192.168.231.0/24 is connected to

outgoing interface: tunnel

source: 192.168.231.0/24

destination: 10.10.10.0/23

Schedule: allways

Service: all

Status: Accept

Nat: no

static Route:

(I assume again that there already is a route for 192.168.230.0/24 as you say the tunnel works)

10.10.10.0/23 over the Tunnel

This should enable you the reaych 10.10.10.0/23 from out of 192.168.231.0.

You could also debug this by doing:

diag debug enable

diag debug flow show console enable

diag debug flow filter saddr/daddr <ip> 

diag debug flow start trace <number of packets>

on cli.

After that do a ping to an ip in 10.10.10.0/23 on Side B and you will see what your FGT does with the packets.

Keep in mind that cli will show you the policy id which is by default not viewable in web-gui!