vpn and internet traffic

[adnan_sabir]

ipsec site to site vpn configured. on WAN2 i have staic Ip, and on WAN1 i have normal internet connectivity. i want to use WAN1 for internet traffic and WAN 2 (configured with static ip) for site to site and access vpn. how can i achieve it ? please help me out.

[ede_pfau · Accepted solution]

If you get the routing correct this should be possible.

Create a default route (0.0.0.0/0.0.0.0) pointing to wan1.

Create a host route with the remote IP address of the site-to-site VPN partner, pointing to wan2: e.g. remote address is 1.2.3.4, create '1.2.3.4/32' pointing to wan2.

Of course, you still need another static route for the remote network behind the remote VPN gateway, pointing to the tunnel interface.

This will cover internet access via wan1 and site-to-site VPN via wan2.

VPN dialup access poses a problem: the public IP addresses of the VPN clients are not known in advance. Thus, the FGT will send negotiation traffic out wan1, according to the default route (it doesn't have any better route). So you can offer dialup VPN but only on wan1.

[ede_pfau · Accepted solution]

If you get the routing correct this should be possible.

Create a default route (0.0.0.0/0.0.0.0) pointing to wan1.

Create a host route with the remote IP address of the site-to-site VPN partner, pointing to wan2: e.g. remote address is 1.2.3.4, create '1.2.3.4/32' pointing to wan2.

Of course, you still need another static route for the remote network behind the remote VPN gateway, pointing to the tunnel interface.

This will cover internet access via wan1 and site-to-site VPN via wan2.

VPN dialup access poses a problem: the public IP addresses of the VPN clients are not known in advance. Thus, the FGT will send negotiation traffic out wan1, according to the default route (it doesn't have any better route). So you can offer dialup VPN but only on wan1.

[adnan_sabir]

thanks for clarification. Right now i am only configuring ipsec access vpn on fortigate 100-D, only. suppose i use WAN1 for normal internet and configure WAN2 for Ipsec access vpn. please if you could explain with example. Actually i want to use WAN 2 for my remote users through ipsec vpn access vpn. please explain with example if you could...

[ede_pfau]

As I have already stated: dialup VPN for your remote workers will have to use wan1 as this is the interface through which traffic to unknown sources will flow, by help of the default route. As your remote workers will use arbitrary source addresses they will be undistinguishable from e.g. arbitrary web sites' source addresses - data flow will be directed by the default route.

For this reason I'm convinced that you won't be able to guide web traffic through wan1 and dialup VPN traffic through wan2.

[adnan_sabir]

ok i got it, can we setup two internet connections. like normal normal internet connectivity on WAN1 and static IP on WAN2 and configure ipsec vpn access vpn on WAN2 without defining any split of traffic. is it possible. If not then any other possible solution. actually we have static with 8 Mbps to be used for remote users (VPN purpose). and we have other internet connection (currently in use) which have very good speed like 30 Mbps.  so if i use static ip only then it will have  very slow connectivity for local users..Any suggestions, please..

[ede_pfau]

1- no you can't.

2- put internet access and dialup VPN on the WAN port with the highest bandwidth.

If you knew your dialin users' remote IP address in advance you could dedicate wan2 for this purpose. But you don't.

[adnan_sabir]

ok i got it. Actually i wanted to give access remote users via (dialup vpn) to software (ERP) running on server in main office. I found out one solution if you could give suggestion. is it possible that i configure two ips on server (running that software). Connect one network  interface to existing LAN network and other interface to fortigate firewall. As remote users will be able to access and communicate through network interface which is connected to  fortigate. i am also sharing image to support the question..

[ede_pfau]

...waiting for the image...

but from what you posted, yes doable, but why so complicated? Whether the server is accessed via the LAN interface or a dedicated second interface doesn't make much difference technically. What do you intend to achieve with this?

[adnan_sabir]

i have uploaded  image.. well what i want to achieve is: A ERP software is running on server in Head office. i want to connect  one interface with LAN (192.168.1.0, local network within Head office) and connect other interface of server  to fortigate (192.168.2.1). static/live IP is configured on fortigate. So i suppose  to configure Access/dialup VPN on fortigate so  that remote  could also access ERP software on server in Head office. in my first question i wanted to configure both internet connections static and dynamic on fortigate but access vpn will not work in that case. so what i conclude is keep the existing lan network running as it is in head office with normal internet connectivity. And for remote users configure static ip/live ip on fortigate firewall and connect it to other interface of Server. By setting up Acces vpn on fortigate, remote users will be able to access server. i may do it on windows server but i guess fortigate is lot secure..

[AlexW]

You could use ECMP for this.

http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103 (Scenario 3a/3b)

Configure both internet connections on the Fortigate, and create 2 statics pointing to both internet connections with the same distance. Then use priority to direct outbound internet traffic to use the internet connection you prefer.

This way both routes (internet connections) are in the routing table an could be used. As The fortigate is a statefull firewall traffic comming in on the interface wil go back over the same interface.

This way you can provide a dailup via connection A and provide a normal NAT via connection B.

Regards, Alex