I created a Policy based Ipsec tunnel, with a specific source IP subnet, and destination subnet is set to "all". The specific source subnet is routed into the Ipsec tunnel, it's ok. But the fortigate do some strange things. It routes all traffic initiated from it's every VLAN interface IP to the tunnel and it's a problem for us. Only traffic from it's own IP, traffic from client's is not routed into the tunnel.
If it is policy-based Ipsec VPN, I would start first converting it to route-based, aka Interface-based VPN unless you have policy-based VPN for some specific reasons. How does your firewall looks like that has action "Ipsec"? With policy-based Ipsec, traffic is not really controlled by routes, but by policies - hence the name. So If you want only specific traffic to enter VPN, change destination address to specific subnet that needs to be routed out via tunnel.
The reason why I made a policy based Ipsec is that I would like to put only one specific source subnet into to ipsec, but from that subnet to all destination.
So my firewall policy looks like so:
source: specific subnet
source interface: interface for the specific subnet
outgoing interface: wan interface
I tried to make it with interface based solution too, but with no luck. How should routing looks like there? I think that we can do only with policy routing, so if the source ip is from the specific subnet then route it into the tunnel. Is that true? I think only with static routes it's not possible, because the destination for that traffic is "all"
Yes, but at my situation source is specific, destination is all. How to handle routing in that situation? I guessed policy route is the solution for that, because I can't make a default route to the tunnel. I tested with fortigate's interface as a source in traceroute, but it does'nt match on the created policy route. I'm not sure that policy routes affects self originated traffic, so now I'm waiting for a user to test it.
If you really need to push all traffic to the tunnel, including internet traffic, then probably you need to have 2 default routes, via local internet break-out and via VPN.
Then, as you noted, policy-routes can achieve what you want - for the source of your clients, send traffic to VPN, everything else to local breakout.
Regarding self-originated traffic, by default, it will not follow policy-routes, but you can change setting that it will follow policy routes. This is configured per-service (DNS, FortiGuard, DHCP, LDAP, etc). More information about that:
It seems like the FortiGate is routing all traffic initiated from its VLAN interfaces to the Policy based IPsec tunnel because the destination subnet is set to "all" in the IPSec configuration.
To resolve this issue, you can try configuring the destination subnet to only include the specific subnet that you want to route through the IPSec tunnel. This will ensure that only traffic from the specific subnet is routed through the tunnel, and traffic from other VLAN interfaces is not routed through the tunnel.
You may also want to check the routing table on the FortiGate to ensure that the routes are properly configured for the specific source subnet. If the routing table is not properly configured, it can cause traffic from other VLAN interfaces to be routed through the IPSec tunnel as well.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.