Site-to-Site VPN Routing Internet Traffic

[robertwb2]

So I have something I thought would be quite simple, but I just cannot wrap my head around. 

Right now, I have a Site to Site IPSEC VPN setup between my two 100D Fortigates. 

What I'm looking to do is route all the traffic from Site B thru Site A so we can use some of the public IPs available at Site A over at Site B. My best thought was to route all the traffic from Site B to Site A and exit out to the internet at Site A, but I cannot get the internet traffic to go thru the tunnel and I was hoping someone could step me thru it and see what I'm doing wrong.

Thanks so much

Robert

[rwpatterson]

On second thought, not sure if that would work. You would need to NAT on the way out too. I guess your are stuck with the wide scope on the local side. It is acceptable though since you have a small scope provisioned for Site B.

[robertwb2]

I am thinking I want to use the other option you explained there. What I'm needing is traffic from Site B to have an IP address from Site A. I am going to mess with this here this afternoon, and hope I can get it going. I want that tunnel scope to be small like you mentioned, so thats the end goal! 

[robertwb2]

I must be missing something simple. Without having my Phase 2 setup like:

Site A: Local Address: 0.0.0.0/0 - Remote Address: Site B/24 Site B: Local Address: Site B/24 - Remote Address: 0.0.0.0/0

I cannot get anything to go. The static routes are in, the policies are created and when I have my Phase 2 with that setup, I am able to get out to the internet at Site B using Site A's connection. Anything other than that setup, and I lose it all. I'm still brainstorming. Thanks

Robert

[MikePruett]

Yeah, you need to have the phase 2's specific. (you could be lazy and just do 0.0.0.0 for local and remote subnets on the phase 2's and the tunnel will accept any traffic but it isn't best practice.

[MikePruett]

actually, you may have to use quad zeros as the internet traffic will have IPs you don't know of. So 0.0.0.0 on both sides may be necessary.

[robertwb2]

Ok, so I'm not going crazy! ha!

So what would you say is the best way to achieve what I'm trying to do? I need a group of Site B (local) IPs to have a public IP from Site A. How else could I achieve getting traffic thru to the other side, without opening up a whole can of 0.0.0.0s.

Basically I'm trying to get a small group of IPs of a guest "network" to have the same public IP so that I can run it thru a cloud filtering system.

Thanks so much

Robert

[claytonmeyer]

I would like to understand what other options there are for achieving this. It seems like the only option is to have 0.0.0.0's on both sides. Is that correct?

[rwpatterson]

Once you route the remote traffic to the head end, simply create an IP pool and NAT the policy providing Internet for that small group passing through. This will insure that everyone using that policy will be using the same IP or range reaching the Internet. You don't need to homogenize the IP address between the two units at all.

[kiennt049]

i had same case and are you done?

[kiennt049]

rwpatterson wrote:

For starters, if you want the Internet traffic to flow through the tunnel, you should set that distance shorter than that of your default gateway (at site B). The tunnel should be your preferred gateway, in other words. You may still wish to go out directly for things like DNS, but that's your call.

i had same case.

If i set that distance shorter than my default gateway ( at site B). site B will lost internet, right? Maybe we need using Route by Source like Juniper. i dont know.

Follow as:

0.0.0.0/0 Over Wan1 Gateway: x.x.x.x Distance: 10

0.0.0.0/0 Over Tunnel  Distance: 5

oh my bad: 

"Ipwan Remote site" Over Wan1 Gateway: x.x.x.x Distance: 10

0.0.0.0/0 Over Tunnel  Distance: 10

and 1 more thing, i using another devices for site B (Draytek) for config all traffic to site A ( i knew configuration on Draytek) 

But still can not through internet. Do you know what happening?

Picture Site A: https://forum.fortinet.co...m=169770&tree=true