Any additional settings for FortiGate-VM on GCP?

[Sawtom]

Hi,

I am testing on GCP, to create VPN between FortiGate-VM and the on-prem router.

It is connected over Cloud Interconnect and BGP for Cloud Router.

The routes are correctly advertised(including FG-VM and the on-prem router), but the ping between that two hosts fails.

I want the next hop of FG-VM to connect to Cloud Router, but it seems to connect to the Internet gateway.

Are there any additional settings to set FG's next hop to Cloud Router?

Of course Cloud Router and FG-VM belong to the same VPC network/VPC network subnet.

Please give me some ideas.

regards, 

FortiGate FortiGate Cloud 

[Mitesh]

Hi Sawtom,

Did you change the default route in the VPC.

By default when you create VPC default route pointing towards internet gateway, which needs to b deleted & create new default route which point towards Forti-VM interface IP.

[Sawtom]

Hi @Mitesh 
Thank you for your advice.

I tried some but it's still not working.
When I was creating a route, I set the priority as the new rule gets prior to the default one.
*Instead of deleting the default route which you explain may be used by other instances.

Then I set the next hop as "Default internet gateway", "Specify an instance" and "Specify IP address of an instance".
And "Specify VPN tunnel", it shows nothing.

I will keep doing.

regards,

[Mitesh]

Hi Sawtom,

Can you please share architecture diagram, which will give us better understanding of problem statement. 

[Sawtom]

Hi @Mitesh ,

I would share the architecture here.

Actually I am not sure any more about details of the on-prem side.
Is this helpful for you?

■Physical / Network
Physical:
    VPN/BGP Router --- |On-prem| --- (Service Provider) --- |Google Cloud| --- Cloud Router --- FortiGate-VM
Network (on GCP):
    (Service Provider) --- Cloud Router --- (VPC-NW-A-subnet) --- [nic0]FortiGate-VM

■Logical
Underlay:
    BGP --- |On-prem| --- (Service Provider) --- |GCP| --- BGP
Overlay:
    VPN tunnel --- (BGP) --- |On-prem| --- (Service Provider) --- |GCP| --- (BGP) --- VPN tunnel

regards,

[Mitesh]

Hi Sawtom,

Based on your input i have drawn architecture diagram, is my understanding is right.

[Sawtom]

Hi @Mitesh 
Yes, almost correct: I would like to compose it without Cloud VPN/HA VPN.(This is a test so please understand that.)
To keep VPN tunnel up, I would see 2 patterns;

1.using Cloud VPN(= HA VPN)

2.using FG-VM

regards,

[Mitesh]

Hi Sawtom,

Are you using Cloud VPN or NGFW for IPSec tunnel ?

[Sawtom]

Hi @Mitesh ,

I am using NGFW.(but now actually the tunnel is not up...)