Routing Internet traffic over the vpn into another site is that possible? [SOLVED]

[Daniel_De_Abreu]

Hi to all. I would like some help from you guys. I have a IPSEC VPN site to site working and it' s all good! Let me set the variables for my question SITE -1 International Breakout SITE -2 Local Bandwidth My question is this. I want all my users internet traffic from the local lan on the site 2 to be route using the VPN and breakout out on site-1 and then use the internet. Let me explain why I need this, I am currently in South Africa and here we have what we call Local Bandwidth which mean that I can only browse in local sites in South Africa and this is all manage by my ISP as Bandwidth is a very $$$ in South Africa alot of people uses local Bandwidth for they business. In site 2 where my router is, there is only local Bandwidth and the user need to use international Bandwidth that is why I need site 2 internet traffic to be route using the vpn and then Breakout into the internet in site 1 As far as i was able i manage to create a policy that send all web trafic from SITE -2 over the vpn to site one, but I don’t know how to set-up SITE - 1 to be able to allow this traffic How can I achieve this? Thanks alot

[ede_pfau]

hi, I sincerely hope you have set up your VPNs in Interface Mode so that you have virtual interfaces, routes to these interfaces and policies. If not, recreate your VPN in Interface Mode. Next, to route all traffic over the VPN you need to set the default route (0.0.0.0/0) in site 2 to the VPN interface of FGT2. Traffic arriving on FGT1' s tunnel end will have the addresses from LAN2. So now you need a policy ' VPN_IF' to ' WAN' and allow this traffic outbound. Return traffic will follow the route you already have set, namely that the addresses from LAN2 are to be found behind the (FGT1' s) VPN interface. All of this works without having to assign addresses to the actual VPN interfaces, ie. tunnel ends. In short, to have ALL traffic routed over to FGT1' s site is only a minor addition to the current setup. The easiest way to change the default gateway for your hosts in LAN2 is to change the setting in the DHCP server, obviously.

[Daniel_De_Abreu]

Hi Ede. Thanks very much for your support and getting back to me on this matter. Yes my VPN was set as a Tunnel mode and then I fallow your advice and recreate everything into interface mode and then I was able to route the traffic over the vpn. I am really appreciated your input and I really a lot about this and after a lot of research I got another solution that I would like to share here. What I did was a policy base routing. I set the policy’s allowing traffic on the fortigates over the VPN in SITE-1 and SET-2 and then simple create a policy base route as this FOR HTTPS also repeat the same for http. config router policy edit 1 set input-device " LOCAL-LAN" set src 172.18.0.0 255.255.0.0 set dst 0.0.0.0 0.0.0.0 set protocol 6 set start-port 443 set end-port 443 set gateway 1.1.1.1 set output-device " VPN-TO-SITE-1" next end After done that i manage to browse the internet in SITE-2 using the gateway on SITE-1 and it work nice. I would like to ask one last question? With this set-up all work fine but it' s is abit slow I just would like to know if someone know how could I have a faster VPN? Maybe change my encryption? Thanks alot for all help.

[ede_pfau]

hi, good thah it works for you now. The encryption itself is not slowing down the traffic, I guess, although I would use AES128/SHA1 as an efficient combination in contrast to 3DES/MD5. When SITE-2 browses, the webpages are UPloaded by SITE-1 and that is where the slowdown comes from. I don' t know anything about your WAN connections but I assume it' s some form of ADSL in which the upload direction has (much) less bandwidth than the download direction. Correct me if I' m wrong. Now to your second solution: you used Policy Routing to force specific traffic over the tunnel. Policy Routing is independent of the type of tunnel setup (policy based or interface based) and bypasses the regular routing. It is one way to achieve what you want BUT it will only work for the port you specify, and it will need one Policy Route per port used. For example, try to run Spotify and you' ll see it won' t work as it is not using HTTP or HTTPS...but in general this would be an alternative if regular routing would not be possible.

[Daniel_De_Abreu]

ede_pfau

Hi ede_pfau. I just would like to thank you and everyone that help me on this matter. I was checking why the internet traffic is so slow over the vpn and it a problem on the service provider on the fault line, this problem had being address at the moment and as soon as the line work 100% all should be fine, and yes I know that i am only routing http and https over the vpn and that is what we need there at the moment. One more time thanks alot for all your h

[robertwb2]

Hi...I was going to try to experiment and do this same exact thing, however, I' m confused as to this instruction:

Next, to route all traffic over the VPN you need to set the default route (0.0.0.0/0) in site 2 to the VPN interface of FGT2.

I have my VPN in interface mode, but just not sure where to make that change above. Thanks so much Robert

[ede_pfau]

You create a static route (Router>Static>Static Route) with these parameters: Dest. IP/Mask: 0.0.0.0/0 Device: (drop-down) (select VPN interface) Gateway: (leave at 0.0.0.0) Distance: 5 Priority: 10 assuming you do not already have a static route to this destination. If you have a PPPoE or DHCP WAN connection then there might be a setting to get the default gateway (= the route to 0.0.0.0/0) dynamically. The lower distance of 5 here gives the static route preference over the route to the WAN interface.

[Daniel_De_Abreu]

going to try to experiment and do this same exact thing, however, I' m confused as to this instruction:

HI to all. Just want keep all updated here, my problem with the speed on the vpn was a bug on the FOS 5 patch 4 that only has affected the 40c Unity. Just revert to FOS 5 PATCH 3 and all should be fine. Please let me know if anyone need help with that. Thanks alot,.

[vanc]

ORIGINAL: Daniel De Abreu Just want keep all updated here, my problem with the speed on the vpn was a bug on the FOS 5 patch 4 that only has affected the 40c Unity.

The bug has been fixed in the up-coming 5.0.5. If you are a beta tester, you might have received build 5.0.246. It' s good in that build.

[Daniel_De_Abreu]

Hi Vanc. Thanks very much for the information, appreciated! Thanks