0

We have a setup like the following:

VLAN 90 ---- FORTIGATE ----- INTERNET ----- CISCO ROUTER ----- VLAN 31 IPSEC VPN TUNNEL

I can ping the VLAN 31 router and subnet and the remote can ping my VLAN 90 my router and subnet.

I'd like to route the internet traffic of one of the local machines via the remote VLAN 31's router so the external IP for that machine shows as the remote IP for the internet.

I've tried to put the following config:

> Computer IP: 192.168.90.22 
> Subnet: 255.255.255.0 Router/Gateway:
> 192.168.31.1 
> DNS: Remote DNS server and tried also 8.8.8.8

But it doesn't work. What am I missing here?

0

The default gateway has to be on the same network as your PC (192.168.90.x/24). You need to configure a policy on the Fortigate to route all traffic from 192.168.90.22 through the VPN and set the default gateway of the computer to the IP address of the Fortinet. Look at page 140 on the manual for instructions on how to set this up.

  • Thanks, but my question implies "one local machine" not the whole traffic. Just one FG. – Cy. Jan 9 '15 at 14:12
  • Is it a policy or route based VPN? Either way, you should have the option to set up a policy/route with the IP address of that computer as a source route all traffic over the VPN. – pooter03 Jan 9 '15 at 14:24
  • Thanks, I understand that, but I would like to know what I am missing for the setup I want which is set a computer to route via the remote router. It's like if you had two routers at home and you change the gateway. I want to understand why just changing the gateway here, doesn't make it. – Cy. Jan 9 '15 at 14:33
  • The gateway has to be on the same network as the device. If your computer is 192.168.90.22/24, the default gateway has to be an IP address on the 192.168.90.0 network. After all, the entire point of the router is to route IPs to other networks. You need to set your default gateway to the Fortigate, then create a route in the Fortigate to route all traffic from 192.168.90.22 across the VPN. – pooter03 Jan 9 '15 at 14:45
  • That makes sense then. So adding a policy route is the only option I understand. – Cy. Jan 9 '15 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.