Route everything through DialUp VPN with DHCP WAN address

[msundman]

Scenario

Classic "Hub and Spoke" design with a Fortigate at HQ terminating DialUp IPsec VPNs from Fortigates at branch offices.

All user traffic at the branch offices should be routed through the VPN tunnel to HQ.

Problem

With a static IP on the WAN interface of the branch gates, this is easily accomplished by adding a static host-route (/32) to the HQ Peer IP thorugh the WAN gateway, and then have the default route (/0) point to the DialUp VPN interface.

However, if the branch offices have DHCP assigned WAN interfaces - How do I accomplish the same thing? As we don't know the gateway IP in advance we can't add the static host-route to the HQ gate and I don't want to rely on updating this static route manually if the DHCP gateway changes.

Possible solution

I've managed to solve the problem by:

1) Add a "fake" static host route, for example 10.0.0.1/32 -> VPN Interface.

2) Add a PBR (Policy Based Route) for Incoming If: LAN, Src: 0/0, Dst 0/0 -> 10.0.0.1 (VPN Interface).

3) Add a static def route (0/0), Distance 5, Priority 100 -> VPN Interface.

With the configuration the firewall used the normal DHCP assigned def gateway to establish the VPN tunnel, but all user traffic from the LAN interface is routed through the VPN tunnel by the PBR route.

#1 is needed because the PBR needs a real IP to resolve where to route the traffic and the VPN interface normally don't have any IPs.

#3 is needed for RPF not to block incoming traffic from the VPN interface. When configured with the same distance as the DHCP assigned def gateway (5) this route is added to the routing table, but not used as it have a worse Prio.

Is this the best solution to my problem, or do you guys see any easier/better solution?