AnsweredHot!MPLS Routing Fortinet with AT&T

Author
Greggor25
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/01 14:14:41
  • Status: offline
2019/07/01 14:18:59 (permalink)
0

MPLS Routing Fortinet with AT&T

I'm having some routing issues with an MPLS circuit that terminates on an interface to my Fortinet. 
MPLS Fortinet Interface IP:10.200.66.1
AT&T MPLS HSRP Router IP:10.200.67.2
I've added a static route for 198.105.206.0/24 to HSRP 10.200.67.1.  I've created a security policy for my internal/trusted zone to MPLS to allow everything. I can't ping anything on the other end but the LAN. 
I don't maintain the AT&T Cisco router or any of the config.  I was told by the vendor to add their public blocks via static route and point to HSRP of the cisco router.  I'm at a loss here.
Here is traceroute that shows it makes it to AT&T MPLS router but nowhere else:
Tracing route to ts099.scl.five9.com [198.105.206.150]
over a maximum of 30 hops:

  1   1 ms   <1 ms   1 ms 10.200.32.1
  2   <1 ms   2 ms   3 ms 192.168.53.1
  3   <1 ms   <1 ms   <1 ms bedfordfortigate.daystartv.internal [10.200.106.1]
  4   <1 ms   <1 ms   <1 ms 10.200.67.2
  5   *       *       *   Request timed out.
  6   *   ^C
H:\>
#1
Toshi Esumi
Expert Member
  • Total Posts : 1788
  • Scores: 145
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: MPLS Routing Fortinet with AT&T 2019/07/01 15:30:12 (permalink) ☼ Best Answerby Greggor25 2019/07/12 07:33:09
0
I don't have experiences with AT&T's MPLS. But if they were to asisgn a public subnet on the interface, the HSRP interface should have the public subnet (likely /29, or in addition to 10.200 IPs only to communicate between two Cisco routers). You should be able to call in their support and ask what you should configure on your FGT interface with what GW IP.
#2
Greggor25
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/01 14:14:41
  • Status: offline
Re: MPLS Routing Fortinet with AT&T 2019/07/02 07:13:49 (permalink)
0
I wasn't informed of a public subnet.  I was just told to connect the MPLS to my LAN and add the public routes of the other side via public block.  
#3
Toshi Esumi
Expert Member
  • Total Posts : 1788
  • Scores: 145
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: MPLS Routing Fortinet with AT&T 2019/07/02 08:52:44 (permalink)
0
If the public subnet is supposed to be configured "inside" interface, you must have ordered to get it from AT&T, then AT&T route that particular subnet from/to the internet to/from your MPLS circuit. If you didn't order it but they say they would provide a public subnet like a /30, that must be for "wan-side" interface to connect to thier MPLS router.
Either case, call their support. They would tell exactly what you need to do.
#4
Greggor25
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/01 14:14:41
  • Status: offline
Re: MPLS Routing Fortinet with AT&T 2019/07/09 08:41:36 (permalink)
0
We're working with a VOIP softphone company that ordered the MPLS circuits.  I was told it was a platinum MPLS circuit.  Yesterday we did some troubleshooting where I bypassed the switch I was using and went straight to my firewall and I still can't get out. I hooked a laptop directly up to AT&T's MPLS router and still can't reach the other side.  The softphone people said something about NAT translation isn't working properly. 
#5
rwpatterson
Expert Member
  • Total Posts : 8419
  • Scores: 197
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: offline
Re: MPLS Routing Fortinet with AT&T 2019/07/09 09:20:02 (permalink) ☄ Helpfulby Greggor25 2019/07/12 07:32:39
0
I would run a Wireshark on the WAN port and see what traffic is hitting that interface.

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.19-b0694
FWF60B
FWF80CM (4)
FWF81CM (2)
 
#6
Greggor25
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/01 14:14:41
  • Status: offline
Re: MPLS Routing Fortinet with AT&T 2019/07/12 07:32:17 (permalink)
0
The problem has been identified.  AT&T had a problem with NAT translation and corrected the issue.  
#7
Jump to:
© 2019 APG vNext Commercial Version 5.5