Hi, I've built a site to site GRE tunnel between an HA pair of Fortigate 101F devices (Firmware: 7.4.3build2573) to a remote site with a Debian 12 server acting as a gateway device using the following publications as a guide:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-GRE-Tunnel-monitoring/ta-p/197720
The tunnel starts passing traffic as soon as I add the static routes and incoming and outgoing FW policies. The tunnel will continue to pass traffic for about 5 minutes then fail.
I've traced the issue to the Fortigate equipped site. If I ping a host in my local network from the remote site I can observe the following:
(1) I see the a protocol 47 packet arrive on the "wan1" interface of my Fortigate.
(2) I see the unencapsulated ICMP request cross the "Site_To_Site" tunnel interface on the Fortigate.
(3) I see the unencapsulated ICMP response come back across the "Site_To_Site" tunnel interface.
(4) The packet, is then gone, it never gets encapsulated and passed across wan1 to the remote site.
Similarly, if I initiate a ping from inside my local site to a host at the remote site I see #3, then nothing across the wan (#4).
Nothing in the system event or security event logs at all.
Topology:
Local Site Subnets
172.16.0.0/16 ---- FG101F HA Cluster (wan1: 10.129.222.101)--(Site-to-Site: 172.16.0.1/32)
|
Site_To_Site
|
172.20.0.0/16 ---- Debian 12 Cluster (enp48s0f0: 10.129.192.62)--(tun0: 172.16.0.2/32)
Remote Site Subnets
Local Forti GRE Tunnel Config:
taani-fw1 (gre-tunnel) # show
config system gre-tunnel
edit "Site_To_Site"
set interface "wan1"
set remote-gw 10.129.222.101
set local-gw 10.129.192.62
next
end
Local Forti GRE interface config:
edit "Site_To_Site"
set vdom "root"
set ip 172.16.0.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 172.16.0.2 255.255.255.255
set snmp-index 35
set interface "wan1"
next
Local Forti outgoing GRE Policy
config firewall policy
edit 27
set name "toECC"
set uuid 3ecdc5f4-e874-51ee-603a-dfeed7873c2e
set srcintf "VLAN40" "VLAN30" "VLAN50" "VLAN60" "VLAN70" "VLAN230"
set dstintf "Site_To_Site"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
next
end
Local Forti Incoming Policy
config firewall policy
edit 28
set name "fromECC"
set uuid 62e8f5d0-e874-51ee-fa87-c2bbd577c879
set srcintf "Site_To_Site"
set dstintf "VLAN30" "VLAN40" "VLAN50" "VLAN60" "VLAN70" "VLAN230"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
next
end
Local Static Routes:
config router static
edit 1
set gateway 10.129.192.1
set device "wan1"
next
edit 2
set dst 172.20.0.0 255.255.0.0
set distance 1
set device "Site_To_Site"
next
edit 3
set status disable
set dst 10.129.222.101 255.255.255.255
set distance 1
set blackhole enable
set vrf 0
next
end
Note - Once the tunnel fails, nothing I do seems to bring it back. I have to tear everything down on the local side and reconfigure. Each time I do that, I get the same result - up for a short time then "poof".
Any thoughts? Thanks in advance - Chris
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello
It's not the first time I see GRE issue between two different editors. Last one I've seen just few days ago is GRE between Cisco and Sophos.
Although GRE is simple to configure and "I guess" standard, but seems like editors are not always compatible with each others in GRE.
You may check the below, just in case you missed something from FG side.
In case you couldn't fix it, think about using IPsec for better security.
Thank you for the reply. I hadn't considered a compatibility issue between Fortigate and Debian. I actually started with IPsec but ran into a roadblock on the Debian Strongswan (remote) side with policy based routing. I'll likely go back to that. Wish wireguard was a option on the Fortigate.
GRE was a really attractive option across the private network that both devices are in.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.