Redirect specific traffic to VPN connection

[Doodley]

We have some problems when connecting to a certain website, tabs are loading intermittently but is loading fine to one of our office overseas. We have Fortigate firewalls on both location and a VPN configured to link both offices. Now, from Office A (where I am now) we can' t access the website (WW.XX.YY.ZZ-WW.XX.YY.ZZ subnet range) completely and I want to redirect every connections made to that subnet range to our overseas office thru the existing VPN. Firewall objects and Policy were already in place but when I tried to tracert the site, I am still connected locally and traffic are not even passing thru the VPN link. What am I missing here?

[TuncayBAS]

What type of VPN? If the interface mode, the router did you write?

[ede_pfau]

hi as well, you will need a static route pointing that subrange to the tunnel interface. All policies between your host and that website must allow traffic for that range. This will work without changes in the VPN setup if you are using wildcard Quick Mode selectors (' 0.0.0.0/0' ) otherwise just create a second phase2 for this subnet.

[Doodley]

Hi, Both offices have static IP' s with a VPN tunnel already in place w/c enables both offices for AD/DFS syncing. Type of VPN: IPSec ----- you will need a static route pointing that subrange to the tunnel interface. All policies between your host and that website must allow traffic for that range. This will work without changes in the VPN setup if you are using wildcard Quick Mode selectors (' 0.0.0.0/0' ) otherwise just create a second phase2 for this subnet. ----- Kindly tell me how to do this as I' m not sure on how to do it myself. What will I put on the Firewall Objects (Addresses) and so as the Policy. For sample, lets say my location, office A has a static IP of: ZZZ.XXX.CCC.VVV and remote office has AAA.SSS.DDD.FFF. Do I need to configure both Fortigate firewall? Thanks again.

[Christopher_McMullan]

Not policies...the redirection will take place at the point where the FortiGate performs a routing lookup. Policies are basically Access Control Lists (on steroids, because of the UTM, NAT, shaping, etc.). Assuming the website' s IP is 66.171.121.34 (using fortinet.com as an example), a sample static route would be: config router static edit 0 set dst 66.171.121.34 255.255.255.255 set dev tunnel_name end

[Doodley]

Thanks for the reply Chris. But wow, CLI? Is there a way I can do this with Fortinet' s web interface? Instead of a single IP, could I do with IP range?

[Christopher_McMullan]

Of course! Enable Advanced Routing as a feature under System > Config > Features, or else go to Routing under System > Network. Create a new static route. Make the destination the IP of the website you want to visit via the VPN. Make the interface the Phase 1 tunnel name. Distance and metric won' t matter in this case, so click OK, and you' re done. If you want a range, it' ll have to be on subnet mask boundaries. You have to remember I spend more time in the CLI these days than the GUI, so it comes more naturally to list the commands than describe a GUI walk-through in the forums.

[Doodley]

Hi Chris, Thanks again for the reply. Under System-> Network, I can only see Interface, DNS, DNS Server, Explicit Proxy, and Capture Packet - nothing w/c says Routing. Advance routing is also enabled on Config->Features. Using Fortigate 100D. Regards.

[Christopher_McMullan]

Then there should be a complete section down the left-hand side called Router. The path would be Router > Static > Static Routes, Create New, specify the destination subnet and interface, then click OK.

[Doodley]

The only problem with the options Static Route presents is that I cannot see anything related to our existing IPSec tunnel to point the traffic into. Destination IP/Mask: Device: Gateway: Distance: Priority: Comments: Nothing stated under Gateway with our existing VPN connectivity. What am I missing here? Thanks.