need a routing solution between 2 fortigates

[fortinetuser2020]

hi all

see attached diagram, it'll help explain it better

i don't know how to "attack" this

thank you

[fortinetuser2020]

are you sure?

be advised that the pbx gateway is an actual gateway, an independent router. it's not a host

even if you leave the farm aside

when the nat is disabled, i can't even get to 1.1.1.254 from any part of the office 192.168.13.0 lan

i need the nat enabled even for the rule from the office lan to the office pbx lan in order for it to get there

but!, the office fortigate itself is able to reach both 1.1.1.254 and it's wan 10.9.9.14, meaning that the static route is set correctly. what am i missing here?

[ede_pfau · Accepted solution]

Definitively a routing issue, but not on the office FGT but on your office hosts.

Their default gateway has to be 192.168.13.1, the office FGT. These hosts do not need to know anything about the 1.1.1.0 LAN - the default route takes care of all non-local subnets for them.

If the situation at the farm is similar then I suspect that the host settings there are incorrect as well. Farm default gateway is 192.168.16.1.

[fortinetuser2020]

i meant "host" as an example

the pbx gateway is an actual router on it's own

i can't seem to get it to "talk" over the ipsec

maybe that's the problem, the return path like you said

no matter what route i setup in the pbx gateway, he's not putting the traffic via 1.1.1.50

[fortinetuser2020]

Hi Ede

i wanted to thank you for all your help

you gave me some good bearing on the problem

the problem was 2 things :

1 : probably a bug in 5.4.1 that static route was ignored and was sending traffic to the internet instead of via IPSEC int

2 : i needed to "lie" about the phase2 subnets in the tunnel. i've setup another phase2 on the tunnel that "speaks" to 10.9.9.0 even though it doesn't exist on any interface on any of the fortigates.

3 : also a bug in the pbx gateway that didn't save the static route for 192.168.16.0 via 1.1.1.50, after save and reboot it worked

so thank you again

[ede_pfau]

Glad you were able to fix it. Enjoy your FGT and the forums!