Applying Policies to static routes

[skone]

I have a 192.168.1.0 network with the Fortigate as the default gateway (192.168.1.1).  I have a vendor supplied VPN firewall that gives us access to a remote network (192.168.2.0).  The vendor firewall uses a IP on my internal network (192.168.1.2).  I built a static route entry on my Foritgate (route 192.168.2.0/255.255.255.0 to 192.168.1.2) and I can ping devices on the 192.168.2.0 network without any issue.  However, I wanted to apply an IPV4 policy to this traffic, so that I can filter it.  However, it just passes all traffic and I can't seem to get an IP policy to apply to it.  Since the Fortigate is acting like a router for this traffic can I not apply policies to it?  

[ede_pfau]

No, you can't. The FGT is a router (in your setup), and local traffic between hosts on the same subnet is not crossing the FGT.

Alternatively, connect the VPN router to a free port on the FGT (say, DMZ), create a small "transit subnet" like 10.11.12.0/30, assign 10.11.12.1 to the FGT DMZ port and .2 to the VPN router. Then you literally have to create a policy from DMZ to WAN to allow traffic out (ESP or udp/500, udp/4500) to establish the VPN, and 2 policies to/from DMZ/LAN. These control the unencrypted traffic, as you wish.

The default route on the VPN router needs to point to 10.11.12.1. Either you add a second route to your LAN, or NAT the traffic.

[emnoc]

Your best bet is what Ede said or build a secondary address on the interface like a /31 or /30 and put the vendor firewall in place on that secondary if your limited to the total # of ports on the FGT. I believe you could maybe write a policy with src/dst interface being the same port that has the secondary-IP and apply a policy for filtering

i.e /* example assuming the interface is named LAN

FGT

/* LAN port in this example

192.168.1.99/24

192.0.2.1/31

3rdPartyFW

192.0.2.2/31

config sys interface

    edit LAN

              set secondary-IP enable

        config secondaryip             edit 1

               set ip 192.0.2.1/31             next         end

end

config router static

   edit 88888

       set dst 192.168.2.0/24

       set gateway 192.0.2.2    <----the address on 3rdparty vendor gear

       set dev lan

end

config firewall address 

   edit "MYLOCAL-LAN"

set subnet 192.168.1.0/24 next edit "REMOTE_LAN" set subnet 192.168.2.0/24 next

end

config firewall policy edit 0 set srcintf lan set dstintf lan set srcaddr  MYLOCAL_LAN set dstaddr  REMOTE_LAN set action accept set schedule "always" set service "ALL" next

Give that a try and update us.

Ken Felix

[skone]

I can confirm a secondary IP address on the same interface will let you apply policies.

[poundy]

if a LAN device knows the route to the secondary router, they can also talk direct to it. So unless you are OK with that, I'd consider putting this on a different interface.