Hello.
I use Fortigate as L2TP server.
L2TP client from ip 83.Y.Y.75 connects to my FG 87.X.X.35
Everything works, even bgp over l2tp.
But, from fortigate i can't ping client public ip.
The route information shows that the route to the external address goes through a tunnel, but should go through the default route.
How can I fix this?
get router info routing-table details 83.Y.Y.75
Routing table for VRF=0
Routing entry for 83.Y.Y.75/32
Known via "static", distance 15, metric 0, best
* via l2tp-icom tunnel 83.Y.Y.75 vrf 0, tun_id
for example, a neighboring address that does not connect via l2tp
get router info routing-table details 83.Y.Y.74
Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 1, metric 0, best
* vrf 0 87.X.X.33, via wan1
Debug:
diagnose vpn tunnel list name l2tp-icom_0
list ipsec tunnel by names in vd 1
------------------------------------------------------
name=l2tp-icom_0 ver=1 serial=251 87.X.X.35:0->83.Y.Y.75:0 tun_id=83.Y.Y.75 tun_id6=::10.0.2.24 dst_mtu=1500 dpd-link=on weight=1
bound_if=47 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/74408 options[122a8]=npu rgwy-chg frag-rfc run_state=0 role=sync-primary accept_traffic=1 overlay_id=0
parent=l2tp-icom index=0
proxyid_num=1 child_num=0 refcnt=6 ilast=0 olast=0 ad=/0
stat: rxp=1751 txp=1533 rxb=392815 txb=487115
dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=1
natt: mode=none draft=0 interval=0 remote_port=0
fec: egress=0 ingress=0
proxyid=l2tp-icom proto=17 sa=1 ref=3 serial=1 transport-mode add-route
src: 17:87.X.X.35-87.X.X.35:1701
dst: 17:83.Y.Y.75-83.Y.Y.75:0
SA: ref=3 options=1a6 type=00 soft=0 mtu=1454 expire=1361/0B replaywin=2048
seqno=5fe esn=0 replaywin_lastseq=000006d7 qat=0 rekey=0 hash_search_len=1
life: type=01 bytes=0/0 timeout=1791/1800
dec: spi=8ada5de8 esp=aes key=24 56759d5c9835dcd18032a8f4cf59b052b16a1f3b089228eb
ah=sha1 key=20 8d5bfbb791037c0b8513ca5c0c28af6abb95f54a
enc: spi=0a77e29c esp=aes key=24 082413878920fea3a4ecf3a45cb0bb9c17c15a6279f7155c
ah=sha1 key=20 c6e67e476d85be86b3fc2746a9450ac9d68f7be1
dec:pkts/bytes=3502/785630, enc:pkts/bytes=3066/1043459
npu_flag=00 npu_rgwy=83.Y.Y.75 npu_lgwy=87.X.X.35 npu_selid=249 dec_npuid=0 enc_npuid=0
diagnose vpn ike gateway list name l2tp-icom_0
vd: dc1/1
name: l2tp-icom_0
version: 1
interface: wan1 47
addr: 87.X.X.35:500 -> 83.Y.Y.75:500
tun_id: 83.Y.Y.75/::10.0.2.24
remote_location: 0.0.0.0
network-id: 0
created: 537s ago
peer-id: 83.Y.Y.75
peer-id-auth: no
IKE SA: created 1/1 established 1/1 time 80/80/80 ms
IPsec SA: created 1/1 established 1/1 time 30/30/30 ms
id/spi: 1830 93045eb2caa4e10a/07c5d9e5f872ba9a
direction: responder
status: established 537-537s ago = 80ms
proposal: 3des-sha1
key: 9136ecf1a700dc05-0d97fb5604bb887a-933c44ed88c346ba
lifetime/rekey: 86400/85592
DPD sent/recv: 00000000/0000058c
peer-id: 83.Y.Y.75
FortiGate Firmware v7.2.8 build1639
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi @AlexGera ,
- Can you please share following output:
show full router static
i'm use sdwan for outside access & vdom "dc1"
config router static
edit 1
set status enable
set dst 0.0.0.0 0.0.0.0
set distance 1
set comment ''
set sdwan-zone "sdwan-wan"
set tag 0
next
edit 2
set status enable
set dst 10.202.54.0 255.255.255.0
set distance 10
set weight 0
set priority 1
set device "l2t.dc1"
set comment "L2TP tunnels"
set blackhole disable
set dynamic-gateway disable
set link-monitor-exempt disable
set tag 0
set bfd disable
next
edit 3
set status enable
set dst 10.0.0.0 255.0.0.0
set distance 250
set weight 0
set priority 1
set comment ''
set blackhole enable
set link-monitor-exempt disable
set tag 0
set vrf 0
next
edit 4
set status enable
set dst 172.16.0.0 255.240.0.0
set distance 250
set weight 0
set priority 1
set comment ''
set blackhole enable
set link-monitor-exempt disable
set tag 0
set vrf 0
next
edit 5
set status enable
set dst 192.168.0.0 255.255.0.0
set distance 250
set weight 0
set priority 1
set comment ''
set blackhole enable
set link-monitor-exempt disable
set tag 0
set vrf 0
next
end
I've noticed this as well. It's definitely incorrect and makes me worry a bit what might happen should someone connect from behind another Fortigate that has a VPN tunnel already, so I'm pretty interested in finding out if there's a solution for this. I didn't bother to contact support about it because this happens when using the wizard to create tunnels (so it's not like I could have accidentally swapped some addresses around) and I was unable to find any settings to change the behaviour after the fact even using the CLI.
I don't use the wizard.
Well, now you can be even more sure it wasn't something you did that caused the misconfiguration.
No, when I turn off the tunnel, there is no route, and the ping goes to a remote ip address.
Created on 04-19-2024 12:39 PM Edited on 04-19-2024 12:43 PM
Just to illustrate... pulling the routes from the console with the VPN up, this is what shows up...
(some addresses have been changed to protect the guilty)
Fortigate # get router info routing-table details 71.b.c.d
Routing table for VRF=0
Routing entry for 71.b.c.d/32
Known via "static", distance 15, metric 0, best
* via ODVPN tunnel 71.b.c.d vrf 0, tun_id
...which is pretty obviously sending the traffic meant for the external remote endpoint into the tunnel, instead of, well, leaving it alone. The only thing that needs to go into the tunnel would be the traffic meant for the newly-assigned address on the remote end...
Fortigate # get router info routing-table details 10.B.C.D
Routing table for VRF=0
Routing entry for 10.B.C.D/24
Known via "static", distance 10, metric 0, best
* directly connected, l2t.root
Now, that's a little weird because I would have expected it to be pointing at the ODVPN interface, but I can't say that it's wrong. The first entry directing traffic for the remote ODVPN client endpoint into the ODVPN tunnel is definitely wrong tho'.
...and when the tunnel is not active the route to the 71.b.c.d address just points to the gateways for the various upstream connections like everything else on the internet.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1666 | |
1077 | |
752 | |
446 | |
220 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.