routing to Public Internet over IPSEC

[Spiderghom]

Hi Guys,

I am testing a setup with 2 x 80F in two branches ( A and B) connected back to Hub (C) via an Ipsec tunnel.

The local LANs behind the branches can ping the hub local lan through the tunnel . Also I configured a second phase2 selectors to allow another local lan ( /29 each) in the branches to get to the internet through the hub. I have added default route via the ipsec interface in each branch and and a firewall policy allowing the second local lan (/29)  and in the hub the required firewall policy.

For branch B which has the second /29 , the ping towards internet via the hub is working but not in the branch A.

I can see under routing monitor that a static router /29 - branch B is showing but not for /29 - branch A.

I am wondering if I am missing anything. I went to compare the config of A and B and couldnt  find  any difference/issue  except the IP scheme is different.

[Toshi_Esumi]

I'm assuming 2x80F is in HA(a-p) at each branch, and each has only one IPsec to C. Then make sure the C-FGT has those two /29 routes to each IPsec to A and B.
Then you need traceroute from the A's /29 toward the internet to see if it actually goes to C over the tunnel, or not.

I meant "get router info routing-t all" in CLI.

Toshi

[Spiderghom]

Hi Toshi,

There is no HA. A & B are independent. The final setup will have about 10 of 80F..but i am testing at the moment with two branches.

I did the traceroute and it s not getting anywhere.

branch-A # execute traceroute-options source Local-LAN-allowed-to-internet

branch-A # execute traceroute 8.8.8.8 
traceroute to 8.8.8.8 (8.8.8.8), 32 hops max, 3 probe packets per hop, 84 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * *