Hot!Vlan and Lan access through ipsec

Author
torrington
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/06 10:07:41
  • Status: offline
2019/11/08 13:09:45 (permalink)
0

Vlan and Lan access through ipsec

Hello. I have a working ipsec tunnel between two fortigates. I'm able to reach the native lan's on both sides, so everything is fine there.
Site A has lan 192.168.0.1/24 and a vlan 172.1.0.0/16
Site B has lan 192.168.5.1/24
 
I need to reach from site B to vlan 172.1.0.0/16 on site A. 
I have not been able to find a configuration that allow me that, so far I can only reach 192.168.0.1 from site B to A and viceversa. It seams that I'm missing something. Thank for any help on the subject. 
#1

7 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 1747
    • Scores: 143
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: online
    Re: Vlan and Lan access through ipsec 2019/11/08 13:54:12 (permalink)
    0
    If you used the wizard to create a site-to-site VPN, you wouldn't see the button to add a phase2 selector. If that's the case, you need to convert it to "Custom" at the top of the VPN page. Then you would see "Add" button in Phase2 2electors section so that you can add a new selector set:172.1.0.0/16<->192.168.5.0/24.
    #2
    torrington
    New Member
    • Total Posts : 6
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/11/06 10:07:41
    • Status: offline
    Re: Vlan and Lan access through ipsec 2019/11/08 16:10:30 (permalink)
    0
    Hi, thanks for your reply. I've already done that, but still no luck. Any other idea?
    #3
    Toshi Esumi
    Expert Member
    • Total Posts : 1747
    • Scores: 143
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: online
    Re: Vlan and Lan access through ipsec 2019/11/08 16:33:30 (permalink)
    0
    Unless you can share the config "config vpn ipsec phase1-interface", "config vpn ipsec phase2-interface", and related part of "get router info routing-table all" and "config firewall policy", I can't tell if you have all configuration you need properly. 
    But if you are confident with your config, you can check if two selectors are up, or not, with below:
     
    xxx-fg1 # get vpn ipsec tun sum
    'xxxxxx' x.x.x.x:4500  selectors(total,up): 2/2  rx(pkt,err): 245505/0  tx(pkt,err): 439233/0


    The key is if you can see the "2/2". If not, still likely configuration issue somewhere above.
    #4
    torrington
    New Member
    • Total Posts : 6
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/11/06 10:07:41
    • Status: offline
    Re: Vlan and Lan access through ipsec 2019/11/08 17:32:59 (permalink)
    0
    Sure, I'm attaching config for site A and B. Thank you.
    #5
    Toshi Esumi
    Expert Member
    • Total Posts : 1747
    • Scores: 143
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: online
    Re: Vlan and Lan access through ipsec 2019/11/08 21:44:59 (permalink)
    0
    You originally posted below
    torrington
    Site A has lan 192.168.0.1/24 and a vlan 172.1.0.0/16
    Site B has lan 192.168.5.1/24

    By you labeled oppositely in the config file, which I'll ignore here. But I see the main problem is routing and policies.
    1) There is no static route from the site with 192.168.5.0/24 to the other side for 172.1.0.0/16 toward the tunnel.
    2) you have two parallel IPSec "forum" and "porwan" you never mentioned about and one side has two parallel routes for 192.168.5.0/24 to both. Without policy routes or something else you are not showing, it wouldn't work well. But I'll ignore this here too.
    3) Both sides of policies doesn't allow traffic from/to 172.1.0.0/16. Only between the original subnets.
     
    Probably you would see "1/2" (up/total) in "get vpn ipsec tunnel sum".
     
    #6
    torrington
    New Member
    • Total Posts : 6
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/11/06 10:07:41
    • Status: offline
    Re: Vlan and Lan access through ipsec 2019/11/09 11:51:36 (permalink)
    0
    Toshi, I didn't mention the parallel tunnel because they are not intended to work together. The "porwan" tunnel is always down.
    As you clearly explained to me it was a matter or policies and static routes. I've managed to correct them thanks to your suggestion and is now working as expected.
    One question though, do you know why when I try to add vlan 172 interface in the policy that already has the internal interface, it only allows me to do it from the cli and not the gui? Seems that from gui it only allows to select one. 
    Thank you very much.
    post edited by torrington - 2019/11/09 11:59:41
    #7
    sw2090
    Gold Member
    • Total Posts : 468
    • Scores: 23
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Vlan and Lan access through ipsec 2019/11/11 00:56:29 (permalink)
    0
    If you want to be able to access a subnet on site B that is behind the Tunnel coming from site A you will have to make sure that you not only have polilcies that allow this traffic but you also have to have routing for that subnet on site.
     
    So this means:
     
    Site B has to have a policy that allows traffic from 192.168.5.0/24 to 172.1.0.0/16 with src interface where your lan is and  ds interface the tunnel.
    Site B  has to have a route to 172.1.0.0/16 via the tunnel.
     
    Site A has to have a policy that allows traffic from 192.168.5.0/24 to 172.1.0.0/16 with src interface the tunnel and dst interface the vlan interface.
    Site A has to have a route back to 192.168.5.0/24 via the tunnel.
     
    With that everything that is in LAN on Site B and uses the FGT of Site B as default GW will be able to access 172.1.0.0/16 on Site A.
    If you're not yousing the FGT aus default gw you would need to set up a net route fro 172.1.0.0/16 via Site B FGT on your Client.
     
    hth
    Sebastian
     
    #8
    Jump to:
    © 2019 APG vNext Commercial Version 5.5