hi all
see attached diagram, it'll help explain it better
i don't know how to "attack" this
thank you
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Definitively a routing issue, but not on the office FGT but on your office hosts.
Their default gateway has to be 192.168.13.1, the office FGT. These hosts do not need to know anything about the 1.1.1.0 LAN - the default route takes care of all non-local subnets for them.
If the situation at the farm is similar then I suspect that the host settings there are incorrect as well. Farm default gateway is 192.168.16.1.
Nice diagram!
Imagine you are a packet on the farm's PBX on your way to the main PBX gateway. You need to know the addresses of all routers between you and the target address. On each router on the way, you store the info of target network and (only) it's next hop (= next router address) as a static route.
Starting at farm VM (192.168.16.x): target is office PBX gateway at 1.1.1.254
1st router is farm FGT (192.168.16.1)
needs to know where 1.1.1.0/24 is: via 192.168.13.1
so, needs to know where 192.168.13.0/24 is: behind VPN tunnel (no gateway needed here as VPN Ipsec tunnels in FortiOS usually do not have IP addresses at their endpoints ('unnumbered'))
Next router is Office FGT (192.168.13.1):
needs to know where 1.1.1.0/24 is: via 192.168.13.5
Next router is Office LAN NIC (192.168.13.5):
needs to know where 1.1.1.0/24 is: directly connected via 1.1.1.1
So, counting all 'needs to know' you need 4 static routes on the routers involved.
BTW, your tunnel needs to carry both the 192.168.13.0 as well as the 1.1.1.0 network (phase2, Quick mode selectors). Just create one phase2 for each network and bind it to the same phase1.
Sure, at least 2 routes are missing.
We can proceed if you post the existing routes on .16.1 and .13.1. And can't without.
2 things to correct:
1- on the FARM FGT, add a route to 10.9.9.0/24 via 1.1.1.254
2- no need for an explicit route to 1.1.1.0/24 on the office FGT (as directly connected networks are automatically put into the Routing table - see Routing > Monitor)
Of course, the latter won't cause any harm but removing it won't help either.
thank you
i've thought of that
problem is : in the static route creation menu, when you select an IPSEC interface, it wipes the option to dictate a manual gateway
only if i select a lan or wan interface, i can set any default gw i want, but that's not the case in ipsec
how can i overcome that?
Well, you don't. Just specify that the target subnet is behind the tunnel. The receiving router then has to make the decision how to route to it.
Just to clarify:
you specify all routes that are needed for traffic from the farm to the PBX gateway. And then you double check that on the return path you've got all routes defined as well. Each router from the PBX gateway on needs to know where the farm subnet is located and how to reach it.
thank you
"Just specify that the target subnet is behind the tunnel"
this happend naturally when i select the IPSEC TUNNEL interface at the static route
for now, based on my existing settings i've placed in the second diagram, i am able to get to 1.1.1.254 from the farm side (only when nat is enabled on the office incomming side)
but it seems that i can't get from the pbx gateway to the farm back
i'm checking it now
If you have to use NAT to enable traffic flow then you still have a missing route.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1632 | |
1063 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.