Need help creating route between 2 fortigate firewalls

[jayzer08]

Hi

I need help I have 2 Fortigate I need to make connectivity between these 2 firewalls by using vlan 51 each site has different vlan that i want to access on both sites i have a diagram.

[sw2090]

hm on your diagram I see:

both FGT are connected via the same subnet and vlan (172.168.201.0/?? and VID 51). This implies both FGT do have an interface in that vlan and subnet. So they already bascially have a (connected) route. This is automagically there once there is an interface connected to that subnet and vlan.

So if clients/servers/devices behind the FGTs use the corresponding FGT as default gw you will only need static routing for the subnets behind the FGTs plus policies to allow the traffic you need to flow.

So on VCK you would probably need those static routes:

172.16.35.0/24 with gw 172.168.201.20

10.10.10.0/24 with gw 172.168.201.20

10.10.20.0/24 with gw 172.168.201.20

10.10.30.0/24 with gw 172.168.201.20

and on MK2 you migh need:

172.17.200.0/24 with gw 172.168.201.10

10.17.100.0/24 with gw 172.168.201.10

because the routing is the first thing the FGT looks at when it is hit by traffic.

When a route has been found the FGT uses that to determine if there is a matching policy to allow the traffic.

[jayzer08]

Oh! THANKS!

[jayzer08]

Hi 

I'm having issue at MK2 site i cant access the DR site VCK pleae see the debug trace below

PSAFG301EMK2 # id=20085 trace_id=9697 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55343." id=20085 trace_id=9697 func=init_ip_session_common line=5788 msg="allocate a new session-24409910" id=20085 trace_id=9697 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9697 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9698 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55349." id=20085 trace_id=9698 func=init_ip_session_common line=5788 msg="allocate a new session-24409aa1" id=20085 trace_id=9698 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9698 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9699 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55356." id=20085 trace_id=9699 func=init_ip_session_common line=5788 msg="allocate a new session-24409c74" id=20085 trace_id=9699 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9699 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9700 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55363." id=20085 trace_id=9700 func=init_ip_session_common line=5788 msg="allocate a new session-24409e25" id=20085 trace_id=9700 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK" id=20085 trace_id=9700 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)"

PSAFG301EMK2 # id=20085 trace_id=9701 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55474." id=20085 trace_id=9701 func=init_ip_session_common line=5788 msg="allocate a new session-2440b660" id=20085 trace_id=9701 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9701 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9702 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55481." id=20085 trace_id=9702 func=init_ip_session_common line=5788 msg="allocate a new session-2440b7d8" id=20085 trace_id=9702 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9702 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9703 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55488." id=20085 trace_id=9703 func=init_ip_session_common line=5788 msg="allocate a new session-2440ba18" id=20085 trace_id=9703 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9703 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=9704 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->10.17.100.10:2048) from ProdINT. type=8, code=0, id=16, seq=55495." id=20085 trace_id=9704 func=init_ip_session_common line=5788 msg="allocate a new session-2440bbdf" id=20085 trace_id=9704 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.17.100.10 via MK2-VCK" id=20085 trace_id=9704 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)"

[sw2090]

PSAFG301EMK2 # id=20085 trace_id=9697 func=print_pkt_detail line=5618 msg="vd-root:0 received a packet(proto=1, 10.10.10.45:16->172.17.200.254:2048) from ProdINT. type=8, code=0, id=16, seq=55343." id=20085 trace_id=9697 func=init_ip_session_common line=5788 msg="allocate a new session-24409910"

FGT at MK2 received the packet and allocated a new session

id=20085 trace_id=9697 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-172.17.200.254 via MK2-VCK"

FGT at MK2 site found a route for that packet (to 172.17.200.254 via MK2-VCK)

id=20085 trace_id=9697 func=fw_forward_handler line=624 msg="Denied by forward policy check (policy 0)"

Means it failed at Step 3 :) There is a rout matching the destination of the policy and there is a session but there is no policy to be found that matches the packet. And if no policy matches the packet then policy #0 (explicit deny policy and always the last of all policies on a FGT) will match it and it will be denied (that's what "Denied by forward policy check (plicy 0)" means).

So check you policies at MK2 (maybe use the policy lookup feature in gui) as it looks like you are missing a policy or something is wrong in it.