Scenario
Classic "Hub and Spoke" design with a Fortigate at HQ terminating DialUp IPsec VPNs from Fortigates at branch offices.
All user traffic at the branch offices should be routed through the VPN tunnel to HQ.
Problem
With a static IP on the WAN interface of the branch gates, this is easily accomplished by adding a static host-route (/32) to the HQ Peer IP thorugh the WAN gateway, and then have the default route (/0) point to the DialUp VPN interface.
However, if the branch offices have DHCP assigned WAN interfaces - How do I accomplish the same thing? As we don't know the gateway IP in advance we can't add the static host-route to the HQ gate and I don't want to rely on updating this static route manually if the DHCP gateway changes.
Possible solution
I've managed to solve the problem by:
1) Add a "fake" static host route, for example 10.0.0.1/32 -> VPN Interface.
2) Add a PBR (Policy Based Route) for Incoming If: LAN, Src: 0/0, Dst 0/0 -> 10.0.0.1 (VPN Interface).
3) Add a static def route (0/0), Distance 5, Priority 100 -> VPN Interface.
With the configuration the firewall used the normal DHCP assigned def gateway to establish the VPN tunnel, but all user traffic from the LAN interface is routed through the VPN tunnel by the PBR route.
#1 is needed because the PBR needs a real IP to resolve where to route the traffic and the VPN interface normally don't have any IPs.
#3 is needed for RPF not to block incoming traffic from the VPN interface. When configured with the same distance as the DHCP assigned def gateway (5) this route is added to the routing table, but not used as it have a worse Prio.
Is this the best solution to my problem, or do you guys see any easier/better solution?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.