Three FortiGate IPSec VPN problem ...

[wowhsieh]

1. I have created two VPNs, Site-A can access both Site-B and Site-C first local network, but can not access other local vlan networks, neither can access Internet, is it a routing problem?!

2. The VPN Phase 2 selector should add all the specific networks, or can just type 0.0.0.0 for all?

[Toshi_Esumi]

It's called as "hub and spoke" vpn set up, as Site B is the hub.

If you want to use 0/0<->0/0 for the phase2 selectors, you need to match this with the other end. An you need only one phase2 with it. But if you use 10.239.2.0/24<->192.168.222.0/24 for the first set, you need to set 10.239.2.0/24<->10.232.0.0/16 for the second selector.

They you have to take care of two more component, 1) routing, and 2) policies. Check routing table at each FGT specifically the ones going into the tunnel(s).

[wowhsieh]

toshiesumi wrote:

It's called as "hub and spoke" vpn set up, as Site B is the hub.

If you want to use 0/0<->0/0 for the phase2 selectors, you need to match this with the other end. An you need only one phase2 with it. But if you use 10.239.2.0/24<->192.168.222.0/24 for the first set, you need to set 10.239.2.0/24<->10.232.0.0/16 for the second selector.

They you have to take care of two more component, 1) routing, and 2) policies. Check routing table at each FGT specifically the ones going into the tunnel(s).

I do the same lab again several days later but failed(maybe forgot some steps), then I found and refer to this document (https://docs.fortinet.com/document/fortigate/6.0.0/handbook/158063/hub-and-spoke-configuration), it seems more complicate in configuration, but I still failed to create.

Is there another example(with diagram) document that I can refer to?

[Toshi_Esumi]

Nothing is complicated with hub and spoke. If you're using 0/0<->0/0 phase2 selectors, only things you need to take care of are routing and policies. For example, at SiteA those subnets that need to be reached at SiteB and C need routes (startic routes in your case?).

Check with a CLI command is the easiest way:

"get router info routing-table all | grep PHASE1_NAME"

At the hub B, there are two VPNs so all source and destination subnets at A and C need to be in the routing-table toward the respective VPN to be able to relay the traffic.

C's route is mirror image from A.

Then at A, all subnets at B and C need to be allowed in the outgoing policy, then flip the direction in the incoming policy. And B needs to relay all of those from one side to the other so policies toward to/from both A and C needs to allow those. Then again, C's policies are mirror image of A's.

To debug you just need to run sniffing "diag sniffer packet ..." at each FGT to see if the packets to the destinations go into the tunnel or not, then at the receiving side you might want to verify if they're arriving.

Depending on the model of FGT, you likely need to disable ASIC off-loading to see the packets in sniffing. You just need to add "set auto-asic-offload disable". Just don't forget to re-enable it after debugging. It would affect to performance significantly.

You also mentioned Internet access issue. But unless the location's default route is pointing into the tunnel, it must be a local routing/policy issue toward the local internet, which has nothing to do with the tunnels.