Hi folks,
I'm attempting to setup my 2 testbed Fortigate 40F firewalls 6.4.10 to use their loopback interfaces to terminate a site-to-site IPSec VPN tunnel. The tunnel is currently fully operational on the 40F firewalls when not using loopback interfaces. I'm starting to wonder if terminating both ends of the IPSec VPN tunnel on loopback interfaces is a supported configuration in FortiOS 6.x?
Once this configuration is operational and technically understood in the testbed, the configuration will be implemented on our production firewalls.
WAN ports have static public IPs
FW1 Loopback assigned private IP 10.0.0.1 /29
FW2 Loopback assigned private IP 172.16.0.1 /29
Fortigate doc talks about this configuration, but I must be missing something as it does not work.
Any help would be greatly appreciated!
Thanks Jim
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi @JimBo
Thanks for posting the update
The ipsec tunnel can be terminated to the loopback interface, but only the reachability to the loopback IPs should be there.
Can you just tell how the connectivity is between both the loopback IPs.
Take the below sniffer on both the FW and check from which port the traffic is going out to confirm the reachability between loopback
dia sniffer packet any 'host x.x.x.x and host y.y.y.y and icmp' 4 0 l
x.x.x.x and y.y.y.y are your loopback IPs, give the above command and initiate the ping to LB IP.
Hi,
The topology is as follows:
FW1_L0_10.0.0.1--Wan_<public IP>--Public_Internet--FW2_Wan_<public IP>--L0_172.10.0.1
Since both ends use RFC 1918 private addressing these 2 private addresses cannot communicated unless some type of inter-connectivity is provided and thus this is the reason for the tunnel.
I'm thinking SNAT -Loop0 (private ip) to Wan (public IP) should do the trick.
Thanks
Jim
Hi Jim, SNAT cannot be applied to the self-originated traffic within one vdom.
If you specifically need to implement the design, i could recommend you to create two vdoms, let`s say ipsec and root.
root and ipsec vdoms will connect via an intervdom link and root vdom will be the internet-facing one.
You will terminate the VPN on the ipsec vdom and the root vdom will in charge of performing the SNAT.
But I`m not sure if that overall schema(terminating on the loopback and performing SNAT on a physical internet-facing interface) can be beneficial in any way.
Ahmad
Hi Ahmad,
You are correct - I just enabled this in the configuration and it laughed at me.
Our need for terminating our site-to-site IPSec VPNs on the lookback interfaces is to cut down on the number of tunnels between sites. If we can terminate the VPN on a loopback interface -at both ends- the multiple ISP connections should be transparent while redundant. This will allow a lower number of BGP peers as-well.
I sort of get the vdom option but was hoping for something a little less complicated since the Fortigate documentation does speak to this loopback option when running in "Profile-based" mode but doesn't provide the actual details. We operate in the newer "Policy-based" mode but think (Hoping) this should still function.
As a side note, we plan to run private IPv6 addressing over the VPN tunnels as-well.
Thank you
Jim
Hello Jim,
You can use Loopback interfaces for BGP peering, in this way, you can lower the number of BGP peers between your locations.
Thanks
Hi Vladislav
That is true but I still must manage multiple IPSec VPN tunnels. Seems Fortigate would have a complete solution. :)
UPDATE:
The testlab HQ Fortigate 40F
L0 private ip
Wan static public ip
can communicate with
remote testlab Fortigate 40F
Wan static public ip.
(Or the other way around but not both using L0).
50% I guess is better the 0%. :)
Thanks
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1518 | |
1018 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.