Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
JimBo
New Contributor II

Terminate site-to-site IPSec VPN tunnel on loopback interfaces - Fortigate <-> Fortigate

Hi folks,

I'm attempting to setup my 2 testbed Fortigate 40F firewalls 6.4.10 to use their loopback interfaces to terminate a site-to-site IPSec VPN tunnel. The tunnel is currently fully operational on the 40F firewalls when not using loopback interfaces.  I'm starting to wonder if terminating both ends of the IPSec VPN tunnel on loopback interfaces is a supported configuration in FortiOS 6.x?

 

Once this configuration is operational and technically understood in the testbed, the configuration will be implemented on our production firewalls.

 

WAN ports have static public IPs

FW1 Loopback assigned private IP 10.0.0.1 /29

FW2 Loopback assigned private IP 172.16.0.1 /29

 

Fortigate doc talks about this configuration, but I must be missing something as it does not work.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-when-IPSec-VPN-is-bound-to-l...

 

Any help would be greatly appreciated!

Thanks Jim

Thank You JimBo
Thank You JimBo
7 REPLIES 7
asengar
Staff
Staff

Hi @JimBo 

Thanks for posting the update

The ipsec tunnel can be terminated to the loopback interface, but only the reachability to the loopback IPs should be there.

 

Can you just tell how the connectivity is between both the loopback IPs.

Take the below sniffer on both the FW and check from which port the traffic is going out to confirm the reachability between loopback

 

dia sniffer packet any 'host x.x.x.x and host y.y.y.y and icmp' 4 0 l   

x.x.x.x and y.y.y.y are your loopback IPs, give the above command and initiate the ping to LB IP.

@bhishek
JimBo
New Contributor II

Hi,

 

The topology is as follows:

 

 

FW1_L0_10.0.0.1--Wan_<public IP>--Public_Internet--FW2_Wan_<public IP>--L0_172.10.0.1

 

Since both ends use RFC 1918 private addressing these 2 private addresses cannot communicated unless some type of inter-connectivity is provided and thus this is the reason for the tunnel.

 

I'm thinking SNAT -Loop0 (private ip) to Wan (public IP) should do the trick.

Thanks

Jim

Thank You JimBo
Thank You JimBo
aahmadzada

Hi Jim, SNAT cannot be applied to the self-originated traffic within one vdom.
If you specifically need to implement the design, i could recommend you to create two vdoms, let`s say ipsec and root. 

root and ipsec vdoms will connect via an intervdom link and root vdom will be the internet-facing one.

You will terminate the VPN on the ipsec vdom and the root vdom will in charge of performing the SNAT.

But I`m not sure if that overall schema(terminating on the loopback and performing SNAT on a physical internet-facing interface) can be beneficial in any way.

 

Ahmad 

Ahmad
JimBo
New Contributor II

Hi Ahmad,

 

You are correct - I just enabled this in the configuration and it laughed at me.

 

Our need for terminating our site-to-site IPSec VPNs on the lookback interfaces is to cut down on the number of tunnels between sites. If we can terminate the VPN on a loopback interface -at both ends- the multiple ISP connections should be transparent while redundant. This will allow a lower number of BGP peers as-well.

 

I sort of get the vdom option but was hoping for something a little less complicated since the Fortigate documentation does speak to this loopback option when running in "Profile-based" mode but doesn't provide the actual details. We operate in the newer "Policy-based" mode but think (Hoping) this should still function.

 

As a side note, we plan to run private IPv6 addressing over the VPN tunnels as-well.

 

Thank you

Jim

Thank You JimBo
Thank You JimBo
v_ceban

Hello Jim,

You can use Loopback interfaces for BGP peering, in this way, you can lower the number of BGP peers between your locations.

Thanks

Vladislav Ceban
JimBo
New Contributor II

Hi Vladislav

That is true but I still must manage multiple IPSec VPN tunnels.  Seems Fortigate would have a complete solution. :)

Thank You JimBo
Thank You JimBo
JimBo
New Contributor II

UPDATE: 

The testlab HQ Fortigate 40F

L0 private ip

Wan static public ip

can communicate with

remote testlab Fortigate 40F

Wan static public ip.

 

(Or the other way around but not both using L0).

50% I guess is better the 0%. :)

Thanks

Thank You JimBo
Thank You JimBo
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors