Connect branch fortigate to HQ server

[dekker]

Hello,

I want to send SYSLOG files from our branch FG to a SIEM on our HQ.

Just a quick network info on both sites:

Branch:

Fortigate 70D with FortiOS 5.4.1

Fortigate Subnet: 192.168.255.0

Local Network: 172.16.1.0

HQ:

Fortigate 101E with FortiOS 6.0.4

Fortigate Subnet: 172.16.12.0

Local Network :172.16.10.0.

We have a VPN to connect both offices and everything works fine between both 172.16.* networks.

My only issue is trying to connect the Branch FG in that Subnet, to our SIEM with a different subnet.

I can ping the branch network inside the console, but I can't connect to the HQ subnet:

# execute traceroute 172.16.1.1 

traceroute to 172.16.1.1 (172.16.1.1), 32 hops max, 3 probe packets per hop, 72 byte packets

 1  192.168.255.2  0.770 ms  0.693 ms  0.870 ms

 2  172.16.1.1     0.426 ms  0.321 ms  0.361 ms

 

# execute traceroute 172.16.10.52

traceroute to 172.16.10.52 (172.16.10.52), 32 hops max, 3 probe packets per hop, 72 byte packets

 1  * * *

 

When I traceroute to an IP from our HQ, shouldn't it use the same gateway?

What am I missing here?

Thank you

[Dave_Hall]

On the Branch fgt, do you show a route for 172.16.10.0 going out the vpn connection to HQ? Is the SIEM on the 172.16.10.x or 172.16.12.x subnet?

[dekker]

Yes, the static route to 172.16.10.0 is defined on the branch fg, going through the VPN connection.

It was added automatically by the VPN wizard.

The SIEM is on the 172.16.10.x subnet.

[Dave_Hall]

So is the 172.16.10.x subnet a real one at HQ or just a subnet for the VPN connection?  I would have thought 172.16.12.x was the real one at HQ?

[dekker]

We have several VLANs:

Branch:

172.16.1.0

172.16.2.0

172.16.3.0

HQ:

172.16.10.0

172.16.11.0

172.16.12.0

Our HQ FG is on VLAN 12 and the SIEM on VLAN 10.

Through the branch FG I can ping all the local VLANs, but I can't ping any of the HQ ones.

All branch and HQ VLANs can connect with each other without issues.

I can send you some screenshots or config info if you need it.

Thank you