Terminate site-to-site IPSec VPN tunnel on loopback interfaces - Fortigate <-> Fortigate

[JimBo]

Hi folks,

I'm attempting to setup my 2 testbed Fortigate 40F firewalls 6.4.10 to use their loopback interfaces to terminate a site-to-site IPSec VPN tunnel. The tunnel is currently fully operational on the 40F firewalls when not using loopback interfaces.  I'm starting to wonder if terminating both ends of the IPSec VPN tunnel on loopback interfaces is a supported configuration in FortiOS 6.x?

Once this configuration is operational and technically understood in the testbed, the configuration will be implemented on our production firewalls.

WAN ports have static public IPs

FW1 Loopback assigned private IP 10.0.0.1 /29

FW2 Loopback assigned private IP 172.16.0.1 /29

Fortigate doc talks about this configuration, but I must be missing something as it does not work.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-when-IPSec-VPN-is-bound-to-l...

Any help would be greatly appreciated!

Thanks Jim

[asengar]

Hi @JimBo 

Thanks for posting the update

The ipsec tunnel can be terminated to the loopback interface, but only the reachability to the loopback IPs should be there.

Can you just tell how the connectivity is between both the loopback IPs.

Take the below sniffer on both the FW and check from which port the traffic is going out to confirm the reachability between loopback

dia sniffer packet any 'host x.x.x.x and host y.y.y.y and icmp' 4 0 l   

x.x.x.x and y.y.y.y are your loopback IPs, give the above command and initiate the ping to LB IP.

[JimBo]

Hi,

The topology is as follows:

FW1_L0_10.0.0.1--Wan_<public IP>--Public_Internet--FW2_Wan_<public IP>--L0_172.10.0.1

Since both ends use RFC 1918 private addressing these 2 private addresses cannot communicated unless some type of inter-connectivity is provided and thus this is the reason for the tunnel.

I'm thinking SNAT -Loop0 (private ip) to Wan (public IP) should do the trick.

Thanks

Jim

[aahmadzada]

Hi Jim, SNAT cannot be applied to the self-originated traffic within one vdom.
If you specifically need to implement the design, i could recommend you to create two vdoms, let`s say ipsec and root. 

root and ipsec vdoms will connect via an intervdom link and root vdom will be the internet-facing one.

You will terminate the VPN on the ipsec vdom and the root vdom will in charge of performing the SNAT.

But I`m not sure if that overall schema(terminating on the loopback and performing SNAT on a physical internet-facing interface) can be beneficial in any way.

Ahmad 

[JimBo]

Hi Ahmad,

You are correct - I just enabled this in the configuration and it laughed at me.

Our need for terminating our site-to-site IPSec VPNs on the lookback interfaces is to cut down on the number of tunnels between sites. If we can terminate the VPN on a loopback interface -at both ends- the multiple ISP connections should be transparent while redundant. This will allow a lower number of BGP peers as-well.

I sort of get the vdom option but was hoping for something a little less complicated since the Fortigate documentation does speak to this loopback option when running in "Profile-based" mode but doesn't provide the actual details. We operate in the newer "Policy-based" mode but think (Hoping) this should still function.

As a side note, we plan to run private IPv6 addressing over the VPN tunnels as-well.

Thank you

Jim

[v_ceban]

Hello Jim,

You can use Loopback interfaces for BGP peering, in this way, you can lower the number of BGP peers between your locations.

Thanks

[JimBo]

Hi Vladislav

That is true but I still must manage multiple IPSec VPN tunnels.  Seems Fortigate would have a complete solution. :)

[JimBo]

UPDATE: 

The testlab HQ Fortigate 40F

L0 private ip

Wan static public ip

can communicate with

remote testlab Fortigate 40F

Wan static public ip.

(Or the other way around but not both using L0).

50% I guess is better the 0%. :)

Thanks