Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fortinetuser2020
New Contributor

need a routing solution between 2 fortigates

hi all

see attached diagram, it'll help explain it better

 

i don't know how to "attack" this

thank you

1 Solution
ede_pfau

Definitively a routing issue, but not on the office FGT but on your office hosts.

Their default gateway has to be 192.168.13.1, the office FGT. These hosts do not need to know anything about the 1.1.1.0 LAN - the default route takes care of all non-local subnets for them.

 

If the situation at the farm is similar then I suspect that the host settings there are incorrect as well. Farm default gateway is 192.168.16.1.

Ede Kernel panic: Aiee, killing interrupt handler!

View solution in original post

Ede Kernel panic: Aiee, killing interrupt handler!
14 REPLIES 14
ede_pfau
SuperUser
SuperUser

Nice diagram!

Imagine you are a packet on the farm's PBX on your way to the main PBX gateway. You need to know the addresses of all routers between you and the target address. On each router on the way, you store the info of target network and (only) it's next hop (= next router address) as a static route.

 

Starting at farm VM (192.168.16.x): target is office PBX gateway at 1.1.1.254

1st router is farm FGT (192.168.16.1)

needs to know where 1.1.1.0/24 is: via 192.168.13.1

so, needs to know where 192.168.13.0/24 is: behind VPN tunnel (no gateway needed here as VPN Ipsec tunnels in FortiOS usually do not have IP addresses at their endpoints ('unnumbered'))

 

Next router is Office FGT (192.168.13.1):

needs to know where 1.1.1.0/24 is: via 192.168.13.5

 

Next router is Office LAN NIC (192.168.13.5):

needs to know where 1.1.1.0/24 is: directly connected via 1.1.1.1

 

So, counting all 'needs to know' you need 4 static routes on the routers involved.

 

BTW, your tunnel needs to carry both the 192.168.13.0 as well as the 1.1.1.0 network (phase2, Quick mode selectors). Just create one phase2 for each network and bind it to the same phase1.

 

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
fortinetuser2020
New Contributor

Hi

first of all, thank you! :)

second, lets ignore 192.168.13.5, that's actually a vm

i'm making another diagram of what i've got so far, maybe you'll have an idea

 

ede_pfau

Sure, at least 2 routes are missing.

We can proceed if you post the existing routes on .16.1 and .13.1. And can't without.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
fortinetuser2020

thank you

these are the static routes from both sides

the upper one is the farm and the lower one is the office

 

ede_pfau

2 things to correct:

1- on the FARM FGT, add a route to 10.9.9.0/24 via 1.1.1.254

2- no need for an explicit route to 1.1.1.0/24 on the office FGT (as directly connected networks are automatically put into the Routing table - see Routing > Monitor)

 

Of course, the latter won't cause any harm but removing it won't help either.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
fortinetuser2020

thank you

i've thought of that

problem is : in the static route creation menu, when you select an IPSEC interface, it wipes the option to dictate a manual gateway

only if i select a lan or wan interface, i can set any default gw i want, but that's not the case in ipsec

how can i overcome that?

ede_pfau

Well, you don't. Just specify that the target subnet is behind the tunnel. The receiving router then has to make the decision how to route to it.

Just to clarify:

you specify all routes that are needed for traffic from the farm to the PBX gateway. And then you double check that on the return path you've got all routes defined as well. Each router from the PBX gateway on needs to know where the farm subnet is located and how to reach it.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
fortinetuser2020

thank you

"Just specify that the target subnet is behind the tunnel"

this happend naturally when i select the IPSEC TUNNEL interface at the static route

for now, based on my existing settings i've placed in the second diagram, i am able to get to 1.1.1.254 from the farm side (only when nat is enabled on the office incomming side)

but it seems that i can't get from the pbx gateway to the farm back

i'm checking it now

ede_pfau

If you have to use NAT to enable traffic flow then you still have a missing route.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors