[Solved] Configuration advice for routing through two fortigate connected in ipsec

[DrKranio]

Good morning everyone, I can't so much as ‘unravel’ a configuration and I'm trying to ask some of you if you can give me some advice.

Host from network 10.0.0/24 ping host to network 192.168.0.0/24

all ipsec between the three firewalls are configured and working

I can only configure the first two firewalls (from left to the right)
i have tried putting static routes, adding the 192.168.0.0 network in the vpn tunnels and also in the policies but i still cannot reach the host 192.168.0.20 from 10.0.0.20

Thanks a lot

[ebilcari]

If you can't manage the 3rd firewall it may not be possible to route the traffic end to end. If an existing subnet on the 1st or 2nd firewall is able to reach (192.168.0.20) and if the requirement is to allow traffic initiated from 10.0.0.20, you can source NAT this traffic with one of the subnets. It is not an ideal solution but it's a workaround if you can't make changes on the 3rd firewall.

[DrKranio]

I misunderstood because it is complicated for me to do so. From firewall 2 to firewall 3 there is already an ipsec and I can ask the manager to make changes if needed. The networks that are in firewall 2 for example 10.0.2.0/24 already ping the network 192.168.0.0/24, I would need them to also ping it from firewall 1 through 2

[dingjerry_FTNT]

Hi @DrKranio ,

1) You need to ensure that the Ping traffic from the 10.0.0.0/24 network hits the FGT2.

2) You need to ensure that the Ping traffic enters into the IPSec VPN tunnel on the FGT2.

3) I assume that you are using a Route-based (AKA Interface-based) IPSec VPN.  So we can confirm the above by this command on FGT2 by Pinging 192.168.0.20:

diag sniffer packet any 'icmp and host 192.168.0.20' 4

We are supposed to see the Ping packets coming out of the Left VPN tunnel and entering into the Right VPN tunnel.

If you can't see the Ping packets coming out, go back to the FGT1 running the same command to check the Ping flow.

If you see the Ping packets entering into the Right VPN tunnel, it's the FGT3 Admin to ensure to allow the Ping traffic.

[DrKranio]

Thank you very much but my problem is just before, the ping was an example.

I can't get traffic from network 10.0.0 to network 192.168.0.0 from firewall 1 to firewall 3 through firewall 2. The three firewalls are connected via IPSEC so they have in phase 2 all networks involved as well as inbound and outbound policies and services required. In addition, in the static routes of firewall 1 I told it that the network 192.168.0.0 must look for it in firewall 2 by passing through the ipsec tunnel that connects firewall 1 to firewall 2 which then in turn looks for it in the ipsec to firewall 3 (and this works because from firewall 2 if I look for the network 192.168.0.0 I can ping the hosts without any problems).

I hope I've explained myself better, I'm missing a piece of configuration somewhere but I can't figure out in which step

[dingjerry_FTNT]

Hi @DrKranio ,

To be honest, your description is unclear.

Just please answer my questions:

1) I name three FGTs from Left to Right as FGT1, FGT2, FGT3.

2) Again, I assume that you are using Route-based IPSec and Ping 192.168.0.20,

You did not confirm this.

2.1) If no, stop here and let me know, and I will provide you with some other commands.

2.2) If yes, go to Step 3.

3) Please run the following command on FGT1 first:

diag sniffer packet any 'icmp and host 192.168.0.20' 4

Can you see the Ping packets entering into the correct IPSec VPN tunnel on FGT?

3.1) If no, stop here. I will provide you with some other steps and commands.

3.2) If yes, go to step 4.

4) Run the same command on FGT2:

diag sniffer packet any 'icmp and host 192.168.0.20' 4

Do you see the Ping packets out and entering into the correct IPSec VPN?

[DrKranio]

Thank you all, I have solved my problem, I apologise for not answering more. I finally figured out how to solve it thanks to the following video "[Fortigate] Hub-and-Spoke VPN configuration" which explained exactly what I needed to do so I could figure out which part of the configuration I had not done

Thanks again