Ping CLI on web panel and SSH does not respond to FG VPN
I have the following scenario:
I have two Fortigate connected via Ipsec VPN (FG 80E HQ + FG 50E BRANCH)
Behind the FG 80E HQ I have a Windows DNS server, resolving the DNS of the station behind the FG 50E.
However, in the web management console of the FG 50E Branch in the DNS -> DNS Settings option, I specify DNS windows behind the FG 80E HQ.
However DNS Servers is red, indicating that the Windows DNS server was not found.
When pinging through the CLI console on the web panel or via SSH an error message appears, as shown in the image attached in this post.
The LAN interface ip on the FG 80E HQ also does not respond to ping.
The issue in both cases is source IP. The fortigate will use the interface IP it leaves from as it's source, in this case the IPSEC tunnel. The problem being that by default that IP is going to be 0.0.0.0 so it's effectively unroutable as a source IP. Unless you want to IP your IPSEC tunnel interfaces and make them routable you need to specify the source IP.
config sys dns
set source-ip x.x.x.x
exec ping-options source x.x.x.x
exec ping x.x.x.x
There are source ip options like this for other services as well.. LDAP, RADIUS, etc. That are useful for IPSEC tunnels.
I configured the Tunel interface, removing the default ip 0.0.0.0 and adding the source ip (Addressing mode
Manual IP 10.1.2.1/32 and remote IP / Netmask 10.1.1.1/24 - Destination IP)
I tried to route IP from the IPSENC VPN interface, but I'm not getting it.
The commands I put above are to get around the need for routable IPSEC interfaces. So that will work when they are set to the default 0.0.0.0.(the source IP you input being the LAN IP)
If you do want to make them routable it's a matter of assigning them a /32 IP on both ends and simply creating a route so it can get to each other. ie, on site A you assign 10.20.20.10/32 and on site B you assign 10.20.20.60/32. On site A create a route sending 10.20.20.60 across the tunnel, and on site B create a route sending 10.20.20.10 across the tunnel. You may need to add the 'routing subnet' to the phase 2 of the tunnel or simply change the phase 2 to 0.0.0.0/0.0.0.0
This will make it so when the traffic originating from the FortiGate itself going across the tunnel has a valid IP and the other side knows how to return the traffic.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.