Vlan and Lan access through ipsec

[torrington]

Hello. I have a working ipsec tunnel between two fortigates. I'm able to reach the native lan's on both sides, so everything is fine there.

Site A has lan 192.168.0.1/24 and a vlan 172.1.0.0/16

Site B has lan 192.168.5.1/24

I need to reach from site B to vlan 172.1.0.0/16 on site A. 

I have not been able to find a configuration that allow me that, so far I can only reach 192.168.0.1 from site B to A and viceversa. It seams that I'm missing something. Thank for any help on the subject. 

[Toshi_Esumi]

If you used the wizard to create a site-to-site VPN, you wouldn't see the button to add a phase2 selector. If that's the case, you need to convert it to "Custom" at the top of the VPN page. Then you would see "Add" button in Phase2 2electors section so that you can add a new selector set:172.1.0.0/16<->192.168.5.0/24.

[torrington]

Hi, thanks for your reply. I've already done that, but still no luck. Any other idea?

[Toshi_Esumi]

Unless you can share the config "config vpn ipsec phase1-interface", "config vpn ipsec phase2-interface", and related part of "get router info routing-table all" and "config firewall policy", I can't tell if you have all configuration you need properly. 

But if you are confident with your config, you can check if two selectors are up, or not, with below:

xxx-fg1 # get vpn ipsec tun sum 'xxxxxx' x.x.x.x:4500  selectors(total,up): 2/2  rx(pkt,err): 245505/0  tx(pkt,err): 439233/0

The key is if you can see the "2/2". If not, still likely configuration issue somewhere above.

[torrington]

Sure, I'm attaching config for site A and B. Thank you.

[Toshi_Esumi]

You originally posted below

torrington wrote:

Site A has lan 192.168.0.1/24 and a vlan 172.1.0.0/16 Site B has lan 192.168.5.1/24

By you labeled oppositely in the config file, which I'll ignore here. But I see the main problem is routing and policies.

1) There is no static route from the site with 192.168.5.0/24 to the other side for 172.1.0.0/16 toward the tunnel.

2) you have two parallel IPSec "forum" and "porwan" you never mentioned about and one side has two parallel routes for 192.168.5.0/24 to both. Without policy routes or something else you are not showing, it wouldn't work well. But I'll ignore this here too.

3) Both sides of policies doesn't allow traffic from/to 172.1.0.0/16. Only between the original subnets.

Probably you would see "1/2" (up/total) in "get vpn ipsec tunnel sum".

[torrington]

Toshi, I didn't mention the parallel tunnel because they are not intended to work together. The "porwan" tunnel is always down.

As you clearly explained to me it was a matter or policies and static routes. I've managed to correct them thanks to your suggestion and is now working as expected.

One question though, do you know why when I try to add vlan 172 interface in the policy that already has the internal interface, it only allows me to do it from the cli and not the gui? Seems that from gui it only allows to select one. 

Thank you very much.

[sw2090]

If you want to be able to access a subnet on site B that is behind the Tunnel coming from site A you will have to make sure that you not only have polilcies that allow this traffic but you also have to have routing for that subnet on site.

So this means:

Site B has to have a policy that allows traffic from 192.168.5.0/24 to 172.1.0.0/16 with src interface where your lan is and  ds interface the tunnel.

Site B  has to have a route to 172.1.0.0/16 via the tunnel.

Site A has to have a policy that allows traffic from 192.168.5.0/24 to 172.1.0.0/16 with src interface the tunnel and dst interface the vlan interface.

Site A has to have a route back to 192.168.5.0/24 via the tunnel.

With that everything that is in LAN on Site B and uses the FGT of Site B as default GW will be able to access 172.1.0.0/16 on Site A.

If you're not yousing the FGT aus default gw you would need to set up a net route fro 172.1.0.0/16 via Site B FGT on your Client.

hth

Sebastian