Route Base VPN problem

[Jirka1]

Hello, I'm trying to set site 2 site IPsec VPN site between 60E and 100D to route all traffic from a specific 60E port to IPsec tunnel (remote browsing). I used a route-based VPN. The minor problem was with the default router, but it was possible to resolve it by setting priorities. The central unit is 100D in the A/P cluster. Behind it is Win2008 (AD, DNS, DHCP) and using DHCP relay at 60E

allocates addresses to clients via IPsec tunnel. It all works. However, the customer's requirement is also the use of two additional ports on the 60E which must go through the WAN interface directly (with NAT) to the Internet (outside the IPsec tunnel). I set the interface, IP ranges, DHCP, DNS, Policy ... Unfortunately, the internet from these networks was inaccessible. I was looking for why and the problem is lower priority (2) default routing for IPsec tunnel - 0.0.0.0/0->TUNNEL  than default route 0.0.0.0/0->DEFAULT GW (4). So I tried to use Policy Routing to define that these two networks should route traffic directly to WAN. Unfortunately, this is not the case. Unfortunately, it does not work So I set up a Policy Base VPN between 60E and 100D. Now all networks are working, but traffic generated at 60E (ping, connect to FAZ, etc.) all goes through this IPsec tunnel, which is undesirable.

How to best solve this scenario? Ideally using a route-based VPN?

Thank you.

[Allan_Lago]

Hm...

Lets do some troubleshooting, with that same configuration do the following.

Run this on Fortigate:

diag debug enable

diag debug show console enable

diag debug flow filter addr x.x.x.x(e.g 172.20.0.1)

diag debug flow trace start 250

ping from x.x.x.x(Change this to the ip you chose above) to 8.8.8.8 and post the results from fortigate CLI here.

[Allan_Lago]

Hi,

Any news?

[Jirka1]

Hi alago, I'm out of office today. I will test it tomorrow. Thank for patience. Jirka