Routing and vpn tunnels

[Alimov]

Hello colleagues. There are two FGT. 1-100d; 2-80c (OS - 5.2) Implemented such a scheme- http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/redundant-tunnel.121.08.html Everything works. The actual schema looks like this: Routs on FGT1: Routs on FGT2: Now I have the task of: If the user of the site 1 has connected on the rdp for Terminal Server in site 2 and Terminal session launched ie-all Internet traffic goes directly to the wan1 FGT2. What do I need to do to traffic sent back in site 1 and already there was outward through the wan1 FGT1 Please tell me what I need to do.

[Alimov]

No, if we put 0.0.0.0 - we are going back to yesterday' s result - regardless of the route policy, traffic flowing on the static route

[hklb]

I think you doing a mistake.. In VPN configuration, you need to leave 0.0.0.0/0 In Interface VPN (You need to set in CLI), you need to set an IP. For that, you need to enter in " config system interface" , and edit your interface tunnel, like I posted yesterday : conf sys inter edit Site_1_A set ip 192.0.2.1 255.255.255.255 set remote-ip 192.0.2.2 next edit Site_1_C set ip 192.0.2.5 255.255.255.255 set remote-ip 192.0.2.6 end

[Alimov]

i do: interface 100d: int 80: dia sys session clear and it is not works vpn tunnel is up local ping is up and access to internet is passed through FGT2

[hklb]

and your PBR configuration?

[Alimov]

FGT80C3912606373 # dia sys session clear FGT80C3912606373 # dia sys session clear FGT80C3912606373 # show router policy config router policy edit 1 set input-device " internal" set src " 192.168.50.0/24" set dst " 0.0.0.0/0" set gateway 192.0.2.2 set output-device " Site_2_A" next end FGT80C3912606373 #

[hklb]

If it always that (attached file), you need to modifiy the gateway to 192.0.2.1

[Alimov]

Oh, my God, hklv, you are the best person on earth !!!! I bow to you. Thank you very much it works !!!!

[hklb]

That' s a good news ! you' re welcome

[hklb]

diag ip rtcache list

Thank you