Redirect specific traffic to VPN connection

[Doodley]

We have some problems when connecting to a certain website, tabs are loading intermittently but is loading fine to one of our office overseas. We have Fortigate firewalls on both location and a VPN configured to link both offices. Now, from Office A (where I am now) we can' t access the website (WW.XX.YY.ZZ-WW.XX.YY.ZZ subnet range) completely and I want to redirect every connections made to that subnet range to our overseas office thru the existing VPN. Firewall objects and Policy were already in place but when I tried to tracert the site, I am still connected locally and traffic are not even passing thru the VPN link. What am I missing here?

[ede_pfau]

You just specify the device and nothing for ' gateway' . The device to route to is the VPN' s phase1 name.

[Doodley]

Hi there... That' s the point in here, I can' t even see the Phase 1 name under device. I' ve checked the VPN->IPSec->Auto Key (IKE) and I see Phase 1 names for my VPN' s but it' s not listed under device.

[Christopher_McMullan]

It' s a policy-based VPN, or " tunnel-based" instead of interface-based or " route-based" . I don' t know why we use two names to describe each type, but we do... In this case, you' ll either have to play with the quick mode selectors to include that web address as a destination, or else delete the VPN, starting with all related policies, then the Phase 2, then the Phase 1, and re-create it to be interface-based. Under the advanced settings in Phase 1, you can accomplish this by selecting the Enabled IPsec Interface Mode option.

[Doodley]

Ok, got that. If I add the web address (IP range of the website were trying to access) to destination address with the quick mode selector, will this have an impact on the current VPN tunnel itself? This VPN tunnel should not go down as we' re using it for our IP telecommunication and AD/DFS syncing.

[Christopher_McMullan]

It would... You' re best to plan to add a new Phase 2 to both sides during a maintenance window.

[Doodley]

This is a bit tricky: What setting will I place on the new Phase 2 for the remote Fortigate? Phase 2 (Local) Source address: Our local IP range (192.168.50.0/24) Destination address: IP range of website Phase 2 (Remote) Source address: ? Destination address: ? Regards.

[Christopher_McMullan]

The direction of QM selectors is outbound, so locally, it' d be local > web subnet; on the remote FortiGate, it' d be source local LAN or wildcard, destination web subnet. Here' s where it gets interesting... The outbound direction of the QM on the remote firewall would seem to indicate a loop: to get to the web subnet, take the tunnel. We' re going in the reverse direction, trying to get out the remote WAN connection un-encapsulated. Since it' s policy-based, if you really still want to go through with this, my coffee-addled brain predicts this is what you' ll need: -Add the QM selector I described to the tunnel referenced in the internal > WAN policy -Create a WAN > WAN policy with the web subnet as the destination, NAT enabled. Let' s get some others weighing in on this solution, since this is just a first attempt at thinking theoretically through the problem.

[rwpatterson]

ORIGINAL: Doodley This is a bit tricky: What setting will I place on the new Phase 2 for the remote Fortigate? Phase 2 (Local) Source address: Our local IP range (192.168.50.0/24) Destination address: IP range of website Phase 2 (Remote) Source address: ? Destination address: ? Regards.

No trick, just reverse the local FGT selectors.

[Doodley]

No trick, just reverse the local FGT selectors.

Could you a bit more specific, please. Let' s make it a step-by-step process as I don' t like to mess up the configuration. LOCAL LOCATION Phase 2 Source Address: 192.168.50.0/24 Destination Address: IP Range of website REMOTE LOCATION Phase 2 Source Address: IP Range of website Destination Address: 192.168.50.0/24 Is this what you mean?

[rwpatterson]

Exactly.