Route traffic from particular private network through second Firebox
Hello, I have two Fireboxes, in two offices. I created BOVPN tunnels and can access private networks on both sides. Now I need to route all traffic that suppose to go to External at Firebox A from network 172.33.5.0 to be routed through Firebox B network 172.66.5.0 to External on Firebox B. How should I do it? Thank you!
0
Sign In to comment.
Comments
You'll need to default route/zero route the BOVPN for that network in the BOVPN tunnel settings.
See:
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/bovpn/manual/vpn_default_route_c.html
-James Carson
WatchGuard Customer Support
Did you set up the default route BOVPN settings for just 172.33.5.0/24 ?
Hi @Leonid
Are you seeing any errors on the firebox system manager front panel, or in the VPN diagnostics? If the VPN was previously working, there's likely a route mismatch.
My best guess is that the route was not changed on the distant side.
If you make the route
192.168.10.0/24 <--> 0.0.0.0/0
you need to make it the inverse on the other firewall, like:
0.0.0.0/0 <--> 192.168.10.0/24
for example.
-James Carson
WatchGuard Customer Support
Thank you all very much, I was able to create a correct tunnel 172.33.5.0/24<>0.0.0.0/0. I can now see traffic going through remote Firebox.
This presents me 2 problems:
1. Regardless I can see ping to google.com allowed at remote firebox it doesn't come back .
2. If I log in through VPN IVEv2 to local firebox and try to ping any address in 172.33.5.0/24 network I'm getting disconnected immediately. This doesn't happen when I log in via L2tP. Also I can see nothing in logs except "User ... login , User ... logout
All this happens only when the tunnel is active
any ideas will be highly appreciated!
thanks
For the IVEv2 VPN client connection - Fireware routing seems to be different for IKEv2 than for other VPN clients.
The reason that I say this is that if one creates a policy to allow internal devices to access an IKEv2 VPN client, one needs to disable Dynamic NAT on that policy, whereas one doe snot need to do this for other VPN client types.
Consider opening a support case for this one.
For the Google ping issue - verify that you have a Dynamic NAT entry which includes 172.33.5.0/24 on firewall B, such as the default one of 172.16.0.0/12
Does all other Internet access work OK from 172.33.5.0/24 except for these pings?
Thank you, Bruce, Nat tule 172.33.5.0/24 to External did the trick. As for IKEv2 VPN client - disabling NAT in FW rule changed nothing, I am going with support on this one.
Cheers
Do note that there are very few reasons to delete or modify the 3 default Dynamic NAT entries, which are for the 3 private IP addr subnets.
Doing so ends up with problems such as you found, and can often be difficult to identify the cause.