Hot!Branch Fortigate use HQ Fortigate as default gateway

Author
Mark Oakton
Gold Member
  • Total Posts : 122
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/08/01 12:00:40
  • Status: offline
2014/08/13 13:36:40 (permalink)
0

Branch Fortigate use HQ Fortigate as default gateway

Hi All,

Have brain freeze and can' t remember how to do, thought I' d ask the experts, hoping for some quick help!

I have a central Fortigate with UTM services, web filtering. etc.

And a remote Fortigate using an IPSEC tunnel to connect to HQ, all users in the remote site need to have their default route go over the VPN - so they can have the same web filtering policies as the HQ network from the HQ firewall.

I have IPSEC tunnel configured (interface mode) and can access ranges in both sites but now need to push the default route over the VPN.

The Fortinet documentation says to edit the static route to 0.0.0.0 and point it over the tunnel interface but if I do that the remote Firewall won' t have is next hop, default gateway listed anywhere - so won' t be able to reach the external peer ID for the VPN as it will not know how to connect.

Am sure I have missed the obvious but its been a long day, any advice very appreciated

Regards,
Mark
#1

19 Replies Related Threads

    Istvan Takacs_FTNT
    Silver Member
    • Total Posts : 118
    • Scores: 15
    • Reward points: 0
    • Joined: 2014/08/05 16:14:08
    • Location: Nowhere, OK
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/13 16:02:09 (permalink)
    4 (1)
    Far from being an expert, I' m a newbie here, but why would you change the default route?

    The way you manage the traffic is by creating FW policies to send the end-users requests into the VPN tunnel and that should deliver them to the HQ.

    The end-users dgw points at the firewall and it sends the requests via the tunnel to the other end.

    The only static route might still be required is from the VPN interface to the other side.
    #2
    ede_pfau
    Expert Member
    • Total Posts : 5749
    • Scores: 397
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/14 01:42:30 (permalink)
    0
    I see your problem. A FGT which has it' s default route on the other end of a tunnel cannot establish that tunnel as it won' t know how to connect to it' s ISP.

    The thing here is that you have to change your clients' default route, not your firewall' s.

    How-to:
    Say, the HQ subnet is 192.168.23.0/24, and the HQ' s FGT is 192.168.23.1. You configure your VPN in Interface Mode (what else) such that the remote subnet behind the tunnel is 192.168.23.0/24. The FGTs default route is either statically assigned or by the WAN protocol (PPPoE, DHCP) and points to your ISP' s gateway router.

    Then the clients: if the FGT is their DHCP server, in the DHCP setup you specify 192.168.23.1 as the default gateway, and let the clients request a lease anew.
    If your clients use static addressing then you have to insert the default route manually on each client.

    Now, what happens if the tunnel won' t come up? No problem on a FGT, you would install 2 default routes, one for backup with a slightly higher priority (" cost" ). On a DHCP client, not so easy. You can try to insert a backup default route on each client using " route -p add" but have to check that the metric is higher than that of the DHCP obtained default route.

    Hope that will do.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #3
    netmin
    Gold Member
    • Total Posts : 209
    • Scores: 22
    • Reward points: 0
    • Joined: 2013/11/28 13:49:12
    • Location: NE, Germany
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/14 23:52:57 (permalink)
    0
    I would try adding a second default route on the VPN interface pointing to the HQ, with same distance, lower priority (preferred) as the first default route on branch wan interface and add dead gateway detection on the tunnel interface. For branch FGT set it' s source ip for ntp, dns, fortiguard to the wan ip address. If that didn' t work as is, add a more specific route to the HQ external IP via the wan interface.

    (One can' t have set a clients default gateway outside their local subnet.)
    #4
    Mark Oakton
    Gold Member
    • Total Posts : 122
    • Scores: 2
    • Reward points: 0
    • Joined: 2014/08/01 12:00:40
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/15 14:25:22 (permalink)
    0
    Hi Istvan,
    Thanks for the response, agreed the traffic can bve managed by policies but the policy will define the destination interface as the tunnel with destination range any, but there is no route in the layer 3 table to send traffic to any IP through the tunnel, so i am sure something needs to be done with the routing table
    #5
    Mark Oakton
    Gold Member
    • Total Posts : 122
    • Scores: 2
    • Reward points: 0
    • Joined: 2014/08/01 12:00:40
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/15 14:30:17 (permalink)
    0
    Hi Ede_pfau,
    You are 100% correct, the problem is that the FW can' t route to the other end of the tunnel as it cant route to the ISP. I dont think changing gateway or route on clients is going to be possible, also the gateway cant be set outside the local range so unsure how this could work
    #6
    Mark Oakton
    Gold Member
    • Total Posts : 122
    • Scores: 2
    • Reward points: 0
    • Joined: 2014/08/01 12:00:40
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/15 14:33:28 (permalink)
    0
    Hi netmin,

    Sure, the gateway cant be set on a different subnet, the second route sounds possible with a different priority, i tried this but with a different distance and lost connectivity - so will try this and let you know

    Also not sure what you mean by set source for ntp, dns, fortiguard to wan ip, do you mean the local wan?

    thanks

    Mark
    #7
    Mark Oakton
    Gold Member
    • Total Posts : 122
    • Scores: 2
    • Reward points: 0
    • Joined: 2014/08/01 12:00:40
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/15 14:38:12 (permalink)
    0
    Hi All,

    This seems to work, I added a secondary route to 0 for the vpn interface, same distance, lower priority (as suggested by netmin)

    Obviously we need the tunnel to be open, not restricted to range on either end, and also a policy and a route on the central firewall to allow the remote range external access

    thanks again for all your help

    Mark

    (attached images of route settings)
    #8
    netmin
    Gold Member
    • Total Posts : 209
    • Scores: 22
    • Reward points: 0
    • Joined: 2013/11/28 13:49:12
    • Location: NE, Germany
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/15 15:02:40 (permalink)
    0
    Excellent job

    The same distance is required to keep both default routes in the routing table (RPF check for traffic arriving on the branch FGT interface), as described here: http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103

    The original intention for changing the source-ip for services of the branch FGT to the WAN ip was to have it using this address. If all works now then there appears to be no need.
    #9
    FGTuser
    Silver Member
    • Total Posts : 98
    • Scores: 5
    • Reward points: 0
    • Joined: 2013/03/11 12:10:25
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/16 02:05:29 (permalink)
    0
    What about setting default route to the tunnel and remote IPSec peer host route (/32) via ISP (instead of default route).

    I think it should work.
    < Message edited by OndrejD -- 8/16/2014 2:07:00 AM >
    #10
    netmin
    Gold Member
    • Total Posts : 209
    • Scores: 22
    • Reward points: 0
    • Joined: 2013/11/28 13:49:12
    • Location: NE, Germany
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/16 02:39:48 (permalink)
    0
    Your are right.

    But using 2 default routes may provide an advantage in the other scenario Ede mentioned (tunnel down) when people at the branch office need to reach some internet resources.
    #11
    FGTuser
    Silver Member
    • Total Posts : 98
    • Scores: 5
    • Reward points: 0
    • Joined: 2013/03/11 12:10:25
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/16 04:34:18 (permalink)
    0
    I think you can' t redirect users via outside when tunnel fails with two default routes:
    -when you have different AD, higher AD will not be in routing table until lower AD is active
    -in case the same AD and different priority, lower priority is always used

    The issue with both options: tunnel interface is always up regardless of tunnel up/down status, so you always have route via tunnel in routing table.

    I was thinking about using dead gateway detection to get rid of tunnel route when tunnel is down, but it' s not possible with tunnel interface.

    < Message edited by OndrejD -- 8/16/2014 4:36:11 AM >
    #12
    netmin
    Gold Member
    • Total Posts : 209
    • Scores: 22
    • Reward points: 0
    • Joined: 2013/11/28 13:49:12
    • Location: NE, Germany
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/16 06:15:31 (permalink)
    0
    I would expect dpd enabled on the phase1 to remove the route - as in redundant VPNs?
    #13
    FGTuser
    Silver Member
    • Total Posts : 98
    • Scores: 5
    • Reward points: 0
    • Joined: 2013/03/11 12:10:25
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/16 07:09:38 (permalink)
    0
    DPD doesn' t help.
    In case site-to-site VPN route is still in routing table when VPN is down, I' ve just tested it and it' s logical behavior, otherwise you couldn' t bring up the tunnel with traffic.
    < Message edited by OndrejD -- 8/16/2014 7:12:46 AM >
    #14
    netmin
    Gold Member
    • Total Posts : 209
    • Scores: 22
    • Reward points: 0
    • Joined: 2013/11/28 13:49:12
    • Location: NE, Germany
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/16 08:27:39 (permalink)
    0
    I assume that there' s something missing. Unfortunately I don' t have spare equipment to test it but if the routes were not removed, the redundant VPN example mentioned here: http://docs-legacy.fortinet.com/fgt/handbook/40mr3/fortigate-ipsec-40-mr3.pdf with 4 identical routes (but different distances in this case) would not work as well, I think.
    #15
    netmin
    Gold Member
    • Total Posts : 209
    • Scores: 22
    • Reward points: 0
    • Joined: 2013/11/28 13:49:12
    • Location: NE, Germany
    • Status: offline
    RE: Branch Fortigate use HQ Fortigate as default gateway 2014/08/17 07:24:31 (permalink)
    5 (1)
    OK - it' s been a rainy day and I set up 2 trial VMs. Everything works as expected. The local P1 interface stays up but as soon as the tunnel goes down on the remote end, all routes defined on the local P1 get removed from the routing table.


    login as: admin
    FortiGate-VM64 # get router info routing-table all

    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
    O - OSPF, IA - OSPF inter area
    N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
    E1 - OSPF external type 1, E2 - OSPF external type 2
    i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
    * - candidate default

    [color=#FF0000]S* 0.0.0.0/0 [10/0] is directly connected, To_FGT1_P1, [3/0][/color]
    [10/0] via 10.0.0.1, port2, [5/0]
    C 10.0.0.0/24 is directly connected, port2
    [color=#FF0000]S 172.16.1.0/24 [10/0] is directly connected, To_FGT1_P1[/color]
    C 172.16.2.0/24 is directly connected, port4
    C 192.168.17.0/24 is directly connected, port1

    ---tunnel goes down remotely---

    FortiGate-VM64 # get router info routing-table all
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
    O - OSPF, IA - OSPF inter area
    N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
    E1 - OSPF external type 1, E2 - OSPF external type 2
    i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
    * - candidate default

    S* 0.0.0.0/0 [10/0] via 10.0.0.1, port2, [5/0]
    C 10.0.0.0/24 is directly connected, port2
    C 172.16.2.0/24 is directly connected, port4
    C 192.168.17.0/24 is directly connected, port1
    #16
    losojos
    New Member
    • Total Posts : 1
    • Scores: 0
    • Reward points: 0
    • Joined: 2015/12/19 04:51:52
    • Status: offline
    Re: RE: Branch Fortigate use HQ Fortigate as default gateway 2015/12/19 05:05:47 (permalink)
    0
    I am dealing with a very similar scenario to the original poster.  It seems, from reading this thread, that there is a solution, but I was not able to grasp exactly what that solution was.  
     
    My scenario:
     
    FG60D with a low bandwidth Metro-E link to a data center, and a high bandwidth DIA circuit, over which there is a VPN tunnel to the same data center.
     
    At the data center is a FG300D
     
    The branch office (FG60D) has voice and data traffic, on separate VLAN's and (obviously) subnets.  The desire is to have all internet (from the data subnet) and data traffic route over the VPN tunnel, while the voice (which only needs to reach the data center, no internet) continues to route over the Metro-E link.
     
    I am able to get everything working, except for the Internet portion.  The need is similar to the original post.  Routing Internet traffic through the data center keeps us HIPA and PCI compliant due to our proxy and expanded licensing on the FG300D.  
    #17
    ede_pfau
    Expert Member
    • Total Posts : 5749
    • Scores: 397
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: RE: Branch Fortigate use HQ Fortigate as default gateway 2015/12/19 12:44:37 (permalink)
    0
    The tricky part is that you need a default route to WAN to set up the VPN in the first place. If the remote FGT's default route points to the tunnel then traffic for the HQ FGT (via internet) would be directed to the tunnel which will result in "flapping".
     
    So, set up one dedicated static route to the HQ IP address, via WAN. Secondly, set up a default route pointing to the tunnel (interface). As the first route is more specific it should be in the Routing table together with the default route. Tunnel "control" traffic (ESP or UDP/500) will not be routed through the tunnel.
     
    This will only work if the other FGT has got a static public IP address.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #18
    antonin75
    New Member
    • Total Posts : 1
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/10 00:19:59
    • Status: offline
    Re: Branch Fortigate use HQ Fortigate as default gateway 2018/08/10 00:38:42 (permalink)
    0
    Hi I had the same problem.
    I solved it by this way:
    1. on bouth sides in VPN - IPsec Tunnels i have to add in Phase 2 Selectors new address maping 
    - on HQ: Local Address: 0.0.0.0/0.0.0.0 , Remote Address: address range of branch office
    - on Branche Local Address:  address range of branch office , Remote Address: 0.0.0.0/0.0.0.0
    2. on HQ add new IPv4 Policy  as incoming interface select IPsec tunnel, outgoing interface select your Wan port, source adress pool for branch office, destination all and turn on NAT and all security profiles and logging options.
    3. on branch FortiGate in Network, static routes
    - add static route for wan ip adress of HQ FortiGate(VPN) trough your Wan IP
    - add static route to 0.0.0.0/0 trough your VPN tunnel with priority 0(default)
    - in first static route to 0.0.0.0/0 in Advanced Options change priority to 1 or higher number
     
    So when I tried tracert to internet address on branch PC i saw that trafic flow trough HQ addresses
    Tony
    It take almost a day to solve it :)
    No one will tell you this easy steps.
    #19
    ede_pfau
    Expert Member
    • Total Posts : 5749
    • Scores: 397
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Branch Fortigate use HQ Fortigate as default gateway 2018/08/10 06:07:37 (permalink)
    0
    No one will tell you this easy steps.

    That is exactly what I wrote in December 2015...hope OP has picked it up in the meantime

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #20
    Jump to:
    © 2018 APG vNext Commercial Version 5.5