need a routing solution between 2 fortigates

[fortinetuser2020]

hi all

see attached diagram, it'll help explain it better

i don't know how to "attack" this

thank you

[ede_pfau]

Nice diagram!

Imagine you are a packet on the farm's PBX on your way to the main PBX gateway. You need to know the addresses of all routers between you and the target address. On each router on the way, you store the info of target network and (only) it's next hop (= next router address) as a static route.

Starting at farm VM (192.168.16.x): target is office PBX gateway at 1.1.1.254

1st router is farm FGT (192.168.16.1)

needs to know where 1.1.1.0/24 is: via 192.168.13.1

so, needs to know where 192.168.13.0/24 is: behind VPN tunnel (no gateway needed here as VPN Ipsec tunnels in FortiOS usually do not have IP addresses at their endpoints ('unnumbered'))

Next router is Office FGT (192.168.13.1):

needs to know where 1.1.1.0/24 is: via 192.168.13.5

Next router is Office LAN NIC (192.168.13.5):

needs to know where 1.1.1.0/24 is: directly connected via 1.1.1.1

So, counting all 'needs to know' you need 4 static routes on the routers involved.

BTW, your tunnel needs to carry both the 192.168.13.0 as well as the 1.1.1.0 network (phase2, Quick mode selectors). Just create one phase2 for each network and bind it to the same phase1.

[fortinetuser2020]

Hi

first of all, thank you! :)

second, lets ignore 192.168.13.5, that's actually a vm

i'm making another diagram of what i've got so far, maybe you'll have an idea

[ede_pfau]

Sure, at least 2 routes are missing.

We can proceed if you post the existing routes on .16.1 and .13.1. And can't without.

[fortinetuser2020]

thank you

these are the static routes from both sides

the upper one is the farm and the lower one is the office

[ede_pfau]

2 things to correct:

1- on the FARM FGT, add a route to 10.9.9.0/24 via 1.1.1.254

2- no need for an explicit route to 1.1.1.0/24 on the office FGT (as directly connected networks are automatically put into the Routing table - see Routing > Monitor)

Of course, the latter won't cause any harm but removing it won't help either.

[fortinetuser2020]

thank you

i've thought of that

problem is : in the static route creation menu, when you select an IPSEC interface, it wipes the option to dictate a manual gateway

only if i select a lan or wan interface, i can set any default gw i want, but that's not the case in ipsec

how can i overcome that?

[ede_pfau]

Well, you don't. Just specify that the target subnet is behind the tunnel. The receiving router then has to make the decision how to route to it.

Just to clarify:

you specify all routes that are needed for traffic from the farm to the PBX gateway. And then you double check that on the return path you've got all routes defined as well. Each router from the PBX gateway on needs to know where the farm subnet is located and how to reach it.

[fortinetuser2020]

thank you

"Just specify that the target subnet is behind the tunnel"

this happend naturally when i select the IPSEC TUNNEL interface at the static route

for now, based on my existing settings i've placed in the second diagram, i am able to get to 1.1.1.254 from the farm side (only when nat is enabled on the office incomming side)

but it seems that i can't get from the pbx gateway to the farm back

i'm checking it now

[ede_pfau]

If you have to use NAT to enable traffic flow then you still have a missing route.