Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
istvanmarlok
New Contributor III

Policy based Ipsec VPN strange behaviour

Hi Team,

 

I have the following issue:

I created a Policy based Ipsec tunnel, with a specific source IP subnet, and destination subnet is set to "all". The specific source subnet is routed into the Ipsec tunnel, it's ok. But the fortigate do some strange things. It routes all traffic initiated from it's every VLAN interface IP to the tunnel and it's a problem for us. Only traffic from it's own IP, traffic from client's is not routed into the tunnel.

Do somebody know the reason for that?

 

Thank you!

 

Best Regards,

Istvan

7 REPLIES 7
AlexC-FTNT
Staff
Staff

I'd start with basic checks for routing. This is clearly a misconfiguration.

get router info routing-table all

get router info routing-table detail x.x.x.x (use the destination IP)

 


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
akristof
Staff
Staff

Hello,

If it is policy-based Ipsec VPN, I would start first converting it to route-based, aka Interface-based VPN unless you have policy-based VPN for some specific reasons. How does your firewall looks like that has action "Ipsec"? With policy-based Ipsec, traffic is not really controlled by routes, but by policies - hence the name. So If you want only specific traffic to enter VPN, change destination address to specific subnet that needs to be routed out via tunnel.

Adrian
istvanmarlok

Hello,

 

The reason why I made a policy based Ipsec is that I would like to put only one specific source subnet into to ipsec, but from that subnet to all destination.

So my firewall policy looks like so:

source: specific subnet

destination: all

source interface: interface for the specific subnet

outgoing interface: wan interface

action: ipsec

 

I tried to make it with interface based solution too, but with no luck. How should routing looks like there? I think that we can do only with policy routing, so if the source ip is from the specific subnet then route it into the tunnel. Is that true? I think only with static routes it's not possible, because the destination for that traffic is "all"

 

Istvan

akristof

Hi.

 

With route-based VPN it is very easy. You have multiple ways how to "restrict" access to VPN for only specific subnet:

1) Specific source/destination selectors

2) Destination route towards IPSec will be specific, only subnet you want to access

3) In firewall policy you can grant access same as in policy-based, with source/destination address. Only difference is that outgoing interface will be selected based on route.

This is example for IPsec with specific selectors. You can ignore that it is for 7k FortiGate, idea is the same:

https://docs.fortinet.com/document/fortigate-7000/5.4.9/fortigate-7000-handbook/100094/adding-source...

Adrian
istvanmarlok

Hi,

 

Yes, but at my situation source is specific, destination is all. How to handle routing in that situation? I guessed policy route is the solution for that, because I can't make a default route to the tunnel. I tested with fortigate's interface  as a source in traceroute, but it does'nt match on the created policy route. I'm not sure that policy routes affects self originated traffic, so now I'm waiting for a user to test it.

 

Do you know an easier solution?

 

Thank you!

akristof

Hi,

If you really need to push all traffic to the tunnel, including internet traffic, then probably you need to have 2 default routes, via local internet break-out and via VPN.

Then, as you noted, policy-routes can achieve what you want - for the source of your clients, send traffic to VPN, everything else to local breakout.

Regarding self-originated traffic, by default, it will not follow policy-routes, but you can change setting that it will follow policy routes. This is configured per-service (DNS, FortiGuard, DHCP, LDAP, etc). More information about that:

196731

Adrian
Faiza_Emam_Delhi
Contributor II

It seems like the FortiGate is routing all traffic initiated from its VLAN interfaces to the Policy based IPsec tunnel because the destination subnet is set to "all" in the IPSec configuration.

To resolve this issue, you can try configuring the destination subnet to only include the specific subnet that you want to route through the IPSec tunnel. This will ensure that only traffic from the specific subnet is routed through the tunnel, and traffic from other VLAN interfaces is not routed through the tunnel.

You may also want to check the routing table on the FortiGate to ensure that the routes are properly configured for the specific source subnet. If the routing table is not properly configured, it can cause traffic from other VLAN interfaces to be routed through the IPSec tunnel as well.

Thanks & Regards,
Faizal Emam
Thanks & Regards,Faizal Emam
Labels
Top Kudoed Authors