fortinet routing issue on the dialup vpn hub version 7.4

[Gurrav]

Hi,

We have SDWAN VPN Dialup with fortios 7.4 

we used BGP for routing

HUB 10.220.1.1/24                                SPOKEN1 10.220.1.2/24

                                                                SPOKEN2 10.220.1.3/24

We have ping from spokens to hub  but no ping from hub to spoken.

we check this links and we see that same problem,  then we tray the solution but it does no worked.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hu...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Potential-routing-issue-on-the-Dialup-VPN-...

please help me

[Toshi_Esumi]

I wouldn't use one phase1-interface when I need to connect two site2site dialup VPNs at a HUB, but would use "peer ID/local ID" setting to separate them and have two phase1-interfaces on the HUB side then BGP to decide which one to route to.

But if you have to have only one phase1-interface for both, try "set net-device enable" on the HUB's phase1-interface config. I because you're config has is disabled (default setting).

Toshi 

[Gurrav]

Hi Toshi,
The set net-device enable command didn't work, and I even lost ping from the spoken devices to the hub.
I rechecked the link community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hub/ta-p/328641, scenario 1, and issued the command on the hub and spoken devices. Then I published the/32 IP addresses over BGP, and it started working.

Thank you very much for responding.

[Toshi_Esumi]

I assumed you already had a /32 static route at least on the spoke side:
config sys int
   edit [phase1_interface_name]
       set ip x.x.x.x 255.255.255.255 
       set remote-ip y.y.y.y 255.255.255.255 <- HUB side IP
   next
end
since you said spokes can ping HUB.
But on the HUB side, since you have one phase1-interface for all spokes, you can't statically configure the "remote-ip" per spoke. Then need to rely on the "set exchange-interface-ip enable" in the KB:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hu...
to pull the remote IP/route when tunnel comes up, which you smartly found out yourself.

That's another reason we always separate phase1-interfaces even for dialup IPsec if site2site, which makes routing simpler and intuitive/predictable.

Toshi