Routing problem between 2 FG Tunnel VPN IPsec

[DavidC]

Hello,

I need help solving a routing problem.

HQ and Brand Fortigate FW are connected via VPN IPsec Site to Site, everything is working fine, we can ping and have access from servers and ressources LAN to LAN from both side. 

I created a static route from Brand's LAN 10.0.151.0/24 to HQ's router 10.0.78.253 on Firewall Arkoon.

We host a SaaS solution with a service provider and this one to authorize the different lan to connect to the solution (France agencies + UK agency)

On our Arkoon Firewall, we have authorized the different LANs that must have access to the LAN of the SaaS solution, 192.168.100.0/24.

This works very well for all the agencies in France, except for the UK LAN with 10.0.151.0/24 addressing.

When i do tracert cmd from a computer brand's LAN 10.0.151.109, I can ping 10.0.78.253 and 10.0.78.254.

But, when I try ping or tracert with 192.168.100.20 it cannot found a route and it fails at first jump after 10.0.151.254.

Thank you in advance.

You can find on my screenshoot : Fortigate FW UK - static routes, ipv4 rules and topology network.

Regards,

[DavidC]

Phil Lofthouse wrote:

Hi David.

It looks like you will need an additional Phase 2 configuring on the Branch FortiGate, to allow 10.0.151.0/24 (local) to have a tunnel to 192.168.100.0/24 (remote), with the opposite configured on the HQ FortiGate.

Regards,

Phil

I added the additional phase 2 as shown and by changing the ipv4 policy from HQ to branch.

It works perfectly, thank you all for your help.

[DavidC]

Phil Lofthouse wrote:

Hi David.

It looks like you will need an additional Phase 2 configuring on the Branch FortiGate, to allow 10.0.151.0/24 (local) to have a tunnel to 192.168.100.0/24 (remote), with the opposite configured on the HQ FortiGate.

Regards,

Phil

I added the additional phase 2 as shown and by changing the ipv4 policy from HQ to branch.

It works perfectly, thank you all for your help.

[Terrell761]

Phil, for my education; what did you see from the information provided to provide that answer? I am looking and I see nothing about Phase 2 mismatched. But, I am a novice.

[Yurisk]

What Phil says, David, beyond routing to the 192.168 via VPN tunnel interface, you have to add Phase 2 Selectors for the networks in question as well.

In Phase 2, I have set Local Address Branch-to-HQ_local 10.0.151.0/24 and Branch-to-HQ_remote 10.0.78.0/24.

 Thank you in advance, 

 Regards.