Hi Guys,
I am testing a setup with 2 x 80F in two branches ( A and B) connected back to Hub (C) via an Ipsec tunnel.
The local LANs behind the branches can ping the hub local lan through the tunnel . Also I configured a second phase2 selectors to allow another local lan ( /29 each) in the branches to get to the internet through the hub. I have added default route via the ipsec interface in each branch and and a firewall policy allowing the second local lan (/29) and in the hub the required firewall policy.
For branch B which has the second /29 , the ping towards internet via the hub is working but not in the branch A.
I can see under routing monitor that a static router /29 - branch B is showing but not for /29 - branch A.
I am wondering if I am missing anything. I went to compare the config of A and B and couldnt find any difference/issue except the IP scheme is different.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I'm assuming 2x80F is in HA(a-p) at each branch, and each has only one IPsec to C. Then make sure the C-FGT has those two /29 routes to each IPsec to A and B.
Then you need traceroute from the A's /29 toward the internet to see if it actually goes to C over the tunnel, or not.
I meant "get router info routing-t all" in CLI.
Toshi
Hi Toshi,
There is no HA. A & B are independent. The final setup will have about 10 of 80F..but i am testing at the moment with two branches.
I did the traceroute and it s not getting anywhere.
branch-A # execute traceroute-options source Local-LAN-allowed-to-internet
branch-A # execute traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 32 hops max, 3 probe packets per hop, 84 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * *
Is the Hub-and-spoke setup dynamic (one phase1-interface configured in hub for all spokes), or static (one phase1 per spoke)?
If dynamic, this raises the question of how you're doing routing on the hub. How does it learn about each spoke's subnets? Dynamic routing (BGP, OSPF, RIP), or does it learn the routes from phase2-selectors ("set add-route enable" in phase1 or phase2)?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1590 | |
1038 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.