AnsweredHot!need a routing solution between 2 fortigates

Author
liorme
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
2017/04/11 02:38:50 (permalink)
0

need a routing solution between 2 fortigates

hi all
see attached diagram, it'll help explain it better
 
i don't know how to "attack" this
thank you

Attached Image(s)

#1
ede_pfau
Expert Member
  • Total Posts : 5153
  • Scores: 320
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 02:57:07 (permalink)
0
Nice diagram!
Imagine you are a packet on the farm's PBX on your way to the main PBX gateway. You need to know the addresses of all routers between you and the target address. On each router on the way, you store the info of target network and (only) it's next hop (= next router address) as a static route.
 
Starting at farm VM (192.168.16.x): target is office PBX gateway at 1.1.1.254
1st router is farm FGT (192.168.16.1)
needs to know where 1.1.1.0/24 is: via 192.168.13.1
so, needs to know where 192.168.13.0/24 is: behind VPN tunnel (no gateway needed here as VPN Ipsec tunnels in FortiOS usually do not have IP addresses at their endpoints ('unnumbered'))
 
Next router is Office FGT (192.168.13.1):
needs to know where 1.1.1.0/24 is: via 192.168.13.5
 
Next router is Office LAN NIC (192.168.13.5):
needs to know where 1.1.1.0/24 is: directly connected via 1.1.1.1
 
So, counting all 'needs to know' you need 4 static routes on the routers involved.
 
BTW, your tunnel needs to carry both the 192.168.13.0 as well as the 1.1.1.0 network (phase2, Quick mode selectors). Just create one phase2 for each network and bind it to the same phase1.
 

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#2
liorme
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 04:17:12 (permalink)
0
Hi
first of all, thank you! :)
second, lets ignore 192.168.13.5, that's actually a vm
i'm making another diagram of what i've got so far, maybe you'll have an idea
 

Attached Image(s)

#3
ede_pfau
Expert Member
  • Total Posts : 5153
  • Scores: 320
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 05:30:38 (permalink)
0
Sure, at least 2 routes are missing.
We can proceed if you post the existing routes on .16.1 and .13.1. And can't without.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#4
liorme
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 06:01:39 (permalink)
0
thank you
these are the static routes from both sides
the upper one is the farm and the lower one is the office
 

Attached Image(s)

#5
ede_pfau
Expert Member
  • Total Posts : 5153
  • Scores: 320
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 07:11:10 (permalink)
0
2 things to correct:
1- on the FARM FGT, add a route to 10.9.9.0/24 via 1.1.1.254
2- no need for an explicit route to 1.1.1.0/24 on the office FGT (as directly connected networks are automatically put into the Routing table - see Routing > Monitor)
 
Of course, the latter won't cause any harm but removing it won't help either.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#6
liorme
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 07:19:13 (permalink)
0
thank you
i've thought of that
problem is : in the static route creation menu, when you select an IPSEC interface, it wipes the option to dictate a manual gateway
only if i select a lan or wan interface, i can set any default gw i want, but that's not the case in ipsec
how can i overcome that?
#7
ede_pfau
Expert Member
  • Total Posts : 5153
  • Scores: 320
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 07:54:59 (permalink)
0
Well, you don't. Just specify that the target subnet is behind the tunnel. The receiving router then has to make the decision how to route to it.
Just to clarify:
you specify all routes that are needed for traffic from the farm to the PBX gateway. And then you double check that on the return path you've got all routes defined as well. Each router from the PBX gateway on needs to know where the farm subnet is located and how to reach it.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#8
liorme
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 09:53:04 (permalink)
0
thank you
"Just specify that the target subnet is behind the tunnel"
this happend naturally when i select the IPSEC TUNNEL interface at the static route
for now, based on my existing settings i've placed in the second diagram, i am able to get to 1.1.1.254 from the farm side (only when nat is enabled on the office incomming side)
but it seems that i can't get from the pbx gateway to the farm back
i'm checking it now
#9
ede_pfau
Expert Member
  • Total Posts : 5153
  • Scores: 320
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 10:03:30 (permalink)
0
If you have to use NAT to enable traffic flow then you still have a missing route.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#10
liorme
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/11 11:20:07 (permalink)
0
are you sure?
be advised that the pbx gateway is an actual gateway, an independent router. it's not a host
 
even if you leave the farm aside
when the nat is disabled, i can't even get to 1.1.1.254 from any part of the office 192.168.13.0 lan
i need the nat enabled even for the rule from the office lan to the office pbx lan in order for it to get there
 
but!, the office fortigate itself is able to reach both 1.1.1.254 and it's wan 10.9.9.14, meaning that the static route is set correctly. what am i missing here?
 
post edited by liorme - 2017/04/11 11:38:02
#11
ede_pfau
Expert Member
  • Total Posts : 5153
  • Scores: 320
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/12 01:00:23 (permalink) ☼ Best Answerby liorme 2017/04/26 22:07:43
0
Definitively a routing issue, but not on the office FGT but on your office hosts.
Their default gateway has to be 192.168.13.1, the office FGT. These hosts do not need to know anything about the 1.1.1.0 LAN - the default route takes care of all non-local subnets for them.
 
If the situation at the farm is similar then I suspect that the host settings there are incorrect as well. Farm default gateway is 192.168.16.1.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#12
liorme
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/26 10:52:15 (permalink)
0
Hi Ede
i wanted to thank you for all your help
 
you gave me some good bearing on the problem
the problem was 2 things :
1 : probably a bug in 5.4.1 that static route was ignored and was sending traffic to the internet instead of via IPSEC int
2 : i needed to "lie" about the phase2 subnets in the tunnel. i've setup another phase2 on the tunnel that "speaks" to 10.9.9.0 even though it doesn't exist on any interface on any of the fortigates.
3 : also a bug in the pbx gateway that didn't save the static route for 192.168.16.0 via 1.1.1.50, after save and reboot it worked
 
so thank you again
#13
ede_pfau
Expert Member
  • Total Posts : 5153
  • Scores: 320
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: need a routing solution between 2 fortigates 2017/04/27 05:38:02 (permalink)
0
Glad you were able to fix it. Enjoy your FGT and the forums!

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#14
Jump to:
© 2017 APG vNext Commercial Version 5.5