fortigate management access through IPsec tunnel

[boneyard]

got a setup with a fortigate cluster at the main office and one cluster on a remote location (both running 5.2). setup a route based IPsec tunnel, added routes, added policies and able to access a server on the remote location from the main location. but want to access the firewall on the remote location also to do management. there are two management access configured interfaces: 1) an IP on one of the internal subnets (which also acts as default gateway for that subnet) 2) the management ports in another internal subnet locally both types of access work fine but via the IPsec tunnel not so well. for 1) i can ping and ssh, but http(s) fails. ssh also fails once the packets get close to 1500 bytes. i see lots of fragmented traffic via wireshark, not sure what is up here. with 2) i cant ping, ssh, http(s) or anything, the traffic reaches the interface according to debug diag flow, but no return traffic is seen. is this something which is simply not possible or should it be? what are the known caveats in a case like this?

[lightmoon1992]

let me start with the second box. as you can read the traffic reaching the interface but not returning back, this apparently reverse route missing. you need to make sure that routing table has entry to reach the first box. you may do this via " get router info routing-table all" or via GUI under routing tab, monitor section Mohammad

[boneyard]

thanks, but the return route is there on the remote location, as mentioned it works up to a degree. with 1) ping works and ssh works until the packet size becomes larger. for access to 2) the same source is used so again the return route should be fine. get router info routing-table all shows the source subnet are directly connected via the IPsec tunnel.

[emnoc]

What you can do; set an ip_address on the route-based ( aka interface mode ) tunnel interface than set allowaccess https/ssh or whatever you need remember, the routed-based interface is an interface with all characteristic of any other interface

[boneyard]

thanks emnoc for the alternative, if the other two fail that sounds like a plan. is it correct im required to configure a remote IP? can i just use something silly without any effect on a normal ipsec tunnel between two fortigates? so far i got a little further with 2) trying to access the physical management interface. this appears to be a policy issue. i hadn' t allowed access from the tunnel to the management interface but to the internal network it was in. i couldn' t add a policy with mgmt as interface because it was a dedicated management interface and then you aren' t allowed to include it in your policy. you can when you make it a normal interface. would it be considered a risk to turn the dedicated management state off? for 1) i still don' t have a clue what is going on. it appears to be some fragmentation issue, but what is causing it ...? i build a similar setup with some VMware Fortigates and it worked without issues.

[emnoc]

yes, you will need ip_address defined on both tunnels and you need to run OSPF across the ipsec-tunnels. Will the effective mtu will be reduce due to the overhead of ESP. So anything trying to meet 1500bytes will need to be fragement or tcp-mss-clamping

[boneyard]

if i just want to reach an IP then i don' t need OSPF or such right? just configure a reachable IP on the other side, perhaps with allow-interface-subnet-overlap or such? it seems the traffic is fragmented, only parts are missing. would tcp-mss-clamping be a solution, where should it be enabled?

[FortiAdam]

I do something very similar to this but with a loopback adapter. Set an IP outside of any of your other ranges and then include that in your phase2 quick mode selector settings. Then just set your routes correctly on both devices and you shouldn' t have any issue with SSH or HTTPS administration from your remote site.

[emnoc]

yes I do the same or use a dynamic routing protocol to get the tunnels address into my core.

[boneyard]

ok, thanks both. but does this mean the method of just accessing a physical interface is known to have issues or ...?