Policy based Ipsec VPN strange behaviour

[istvanmarlok]

Hi Team,

I have the following issue:

I created a Policy based Ipsec tunnel, with a specific source IP subnet, and destination subnet is set to "all". The specific source subnet is routed into the Ipsec tunnel, it's ok. But the fortigate do some strange things. It routes all traffic initiated from it's every VLAN interface IP to the tunnel and it's a problem for us. Only traffic from it's own IP, traffic from client's is not routed into the tunnel.

Do somebody know the reason for that?

Thank you!

Best Regards,

Istvan

[AlexC-FTNT]

I'd start with basic checks for routing. This is clearly a misconfiguration.

get router info routing-table all

get router info routing-table detail x.x.x.x (use the destination IP)

[akristof]

Hello,

If it is policy-based Ipsec VPN, I would start first converting it to route-based, aka Interface-based VPN unless you have policy-based VPN for some specific reasons. How does your firewall looks like that has action "Ipsec"? With policy-based Ipsec, traffic is not really controlled by routes, but by policies - hence the name. So If you want only specific traffic to enter VPN, change destination address to specific subnet that needs to be routed out via tunnel.

[istvanmarlok]

Hello,

The reason why I made a policy based Ipsec is that I would like to put only one specific source subnet into to ipsec, but from that subnet to all destination.

So my firewall policy looks like so:

source: specific subnet

destination: all

source interface: interface for the specific subnet

outgoing interface: wan interface

action: ipsec

I tried to make it with interface based solution too, but with no luck. How should routing looks like there? I think that we can do only with policy routing, so if the source ip is from the specific subnet then route it into the tunnel. Is that true? I think only with static routes it's not possible, because the destination for that traffic is "all"

Istvan

[akristof]

Hi.

With route-based VPN it is very easy. You have multiple ways how to "restrict" access to VPN for only specific subnet:

1) Specific source/destination selectors

2) Destination route towards IPSec will be specific, only subnet you want to access

3) In firewall policy you can grant access same as in policy-based, with source/destination address. Only difference is that outgoing interface will be selected based on route.

This is example for IPsec with specific selectors. You can ignore that it is for 7k FortiGate, idea is the same:

https://docs.fortinet.com/document/fortigate-7000/5.4.9/fortigate-7000-handbook/100094/adding-source...

[istvanmarlok]

Hi,

Yes, but at my situation source is specific, destination is all. How to handle routing in that situation? I guessed policy route is the solution for that, because I can't make a default route to the tunnel. I tested with fortigate's interface  as a source in traceroute, but it does'nt match on the created policy route. I'm not sure that policy routes affects self originated traffic, so now I'm waiting for a user to test it.

Do you know an easier solution?

Thank you!

[akristof]

Hi,

If you really need to push all traffic to the tunnel, including internet traffic, then probably you need to have 2 default routes, via local internet break-out and via VPN.

Then, as you noted, policy-routes can achieve what you want - for the source of your clients, send traffic to VPN, everything else to local breakout.

Regarding self-originated traffic, by default, it will not follow policy-routes, but you can change setting that it will follow policy routes. This is configured per-service (DNS, FortiGuard, DHCP, LDAP, etc). More information about that:

196731

[Faiza_Emam_Delhi]

It seems like the FortiGate is routing all traffic initiated from its VLAN interfaces to the Policy based IPsec tunnel because the destination subnet is set to "all" in the IPSec configuration.

To resolve this issue, you can try configuring the destination subnet to only include the specific subnet that you want to route through the IPSec tunnel. This will ensure that only traffic from the specific subnet is routed through the tunnel, and traffic from other VLAN interfaces is not routed through the tunnel.

You may also want to check the routing table on the FortiGate to ensure that the routes are properly configured for the specific source subnet. If the routing table is not properly configured, it can cause traffic from other VLAN interfaces to be routed through the IPSec tunnel as well.