Output traffic with default route BGP

[danny1989]

Good morning everyone
I recently entered the fortinet world. I have a Fortinet-VM02 that gets the default route via BGP (configured on port3) from our main router. On another interface (port4) the static public IP announced via BGP is configured. Port4 is the WAN port that will provide connectivity to our servers. I have to let the traffic generated by the firewall itself (output) exit from the IP of interface 4 instead of 3 otherwise the firewall does not renew the license or other services that require internet.

the firewall obviously exits from 3 indicating the IP of interface 3 as the source address

The forward traffic is ok, the VMs connected under port 4 navigate with their static IP belonging to the /24 subnet announced via bgp, the problem is only the output traffic of the firewall itself.

thanks to whoever will answer me

[HarshChavda]

Hello @danny1989 ,

You can configure a policy-based route which can directs the firewall’s traffic to use a specific interface based on the source address or other criteria. You can create address object and create policy accordingly.

[Toshi_Esumi]

The FortiGuard IPs your FGT-VM needs to reach are multiple and may change. So at least you need to have static routes to the FQDNs for those IPs toward the port4 if there is no default route to that direction.
https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/301421/update-server-locatio...

Toshi

[vbandha]

Hi @danny1989 ,

For fortiguard traffic originating from fortigate you can specify fortigate interface and source IP for the traffic to take:

https://docs.fortinet.com/document/fortigate/7.0.5/cli-reference/110620/config-system-fortiguard

config system fortiguard

set fortiguard-anycast disable

set interface-select-method specify

set interface <outgoing interface>

set source-ip <IP of the interface>

end

Try that and see if it works for you.

Regards,

Varun

[dingjerry_FTNT]

Hi @danny1989 ,

I think that you have two default routes with the same distance and maybe the one via port3 has a higher priority.

You can check and verify this info using this command:

get router info routing-table all

If this is the case and if the default route via port4 is a static route, the easier way for you:

1) Modify the default route via port4 to have a higher priority;

2) Create a policy route for passthrough traffic via port3; 

[dingjerry_FTNT]

Please refer to this KB for Policy Route configuration:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-Firewall-Policy-Routes/ta-...

[danny1989]

Hi, the router does not have 2 default routes but only one obtained from the BGP session established with our master router on port3

The subnet that we announce to our master router (/24) is configured on port4. The hosts connected to port4 work regularly (forward traffic) the problem is the traffic generated by the firewall itself because it sets the IP of the port3 interface as the source ip address instead of that of port4

[dingjerry_FTNT]

You need to show us the routing table.

So when you have only one default route, and no more specific routes for FGT self-originated traffic (most to the FortiGuard servers), it, of course, will select the default route to be out.

So you may create a static default route via port4 with the same distance and higher priority as the default route via port3, then create policy routes via port3 for passthrough traffic.

[Toshi_Esumi]

That's why I told you above.

FGTs by default use the outgoing interface IP as source IP when they send/initiate packets to outside. The problem is routes toward FTGD don't exist in your FGT to port4 and those packets follow the default route, and picking the port3 IP.
You have to have the routes toward port4 one way or the other.

Toshi

[danny1989]

Ok, let's suppose we have the IP 1.2.3.4 assigned to the Loopback interface

The default route 0.0.0.0/0 is taken via BGP from port3 and the GW is 100.127.0.1

Logically the firewall will try to exit to the Internet via 100.127.0.1 from port3 with the relative IP

How should the route policy be created to replace the source IP address of the traffic generated by the firewall itself from the IP of port3 with that of loopback?

On mikrotik it is enough to create a source nat rule, how do you reason in Fortinet?
Invia commenti