Prioritize IPSec over Local VLAN

[ismail5]

I have VLAN with IP 192.168.100.0/24 and over IPSec network with IP 192.168.100.0./22.

Local users on another VLAN 10.60.18.0/23 need to access the network over IPSec and do not need to access the local network. Current situation is that users are able to access the IPSec network except those IPs that are overlapping with local IP. In other words, users are able to access IP range from 192.168.101.x, 192.168.102.x etc, but are not able to access 192.168.100.x, which because I believe because of the presence of local VLAN, despite having proper firewall policy and static routing.

Any idea how to resolve this?

[atakannatak · Accepted solution]

Hi @ismail5 ,

The overlapping subnet between your local VLAN (192.168.100.0/24) and the remote IPSec subnet (192.168.100.0/22) is causing routing conflicts. By default, FortiGate prioritizes the most specific route, which in this case is the /24 (local VLAN) over the broader /22 (IPSec) route.

Your goal is to ensure that traffic originating from the 10.60.18.0/23 subnet is routed to the remote 192.168.100.x network over the IPSec tunnel, rather than being directed to the local VLAN version of the subnet.

• Remove/Redesign the Overlapping VLAN: If possible, remove or readdress the local VLAN 192.168.100.0/24. This is the cleanest fix — avoid overlapping subnets between local interfaces and remote networks.
• Use Policy Routing (PBR): If you must keep the local VLAN, use a Policy Route to force traffic from 10.60.18.0/23 destined for 192.168.100.0/22 into the IPSec tunnel, bypassing regular routing logic.

• Use VRF: If you're doing multi-tenancy or complex route separation, consider using VRFs (virtual routing instances) to isolate local and IPSec routing tables. This is more advanced and requires architectural change.

        https://community.fortinet.com/t5/FortiGate/Technical-Tip-VRFs-route-leaking/ta-p/280549

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

[funkylicious]

Hi,

Indeed it's because of the local VLAN being configured locally on the FGT.

Since it's a /22 and you have /24 routes configured in the routing table, for those above .100.x ( .101, .102. , .103. ) it will use the routing table to route traffic.

You can confirm this by doing, get router info routing-table details <IP> and it will display as best the static route for the ipsec interface/tunnel.

In my opinion you should consider a longer term solution, such as https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/426761/site-to-site-vpn-with... or do policy routes for some specific IPs in the .100. network