0

I have been trying to cutover one of our remote sites (A) to the new ISP we have purchased. The existing setup is utilizing L2 through another remote site (B) and coming back to the main campus. The new ISP has provided us with a /29 public subnet.

I have been able to create an IPSec tunnel from the router at site_A to main campus fortigate. The main campus switch is handling L2 traffic

My problem resides with having all the traffic traverse this tunnel. I cannot get the existing phones, APs to register through the tunnel.

interface Tunnel4
 ip address 172.31.1.1 255.255.0.0
 tunnel source GigabitEthernet0/3/0
 tunnel mode ipsec ipv4
 tunnel destination {public address}
 tunnel protection ipsec profile TO_FGT

the router is currently acting as the voice gateway as well

interface GigabitEthernet0/0
 ip address 172.17.1.1 255.255.255.0
 ip helper-address 172.16.5.5
 ip helper-address 172.16.5.6
 ip pim sparse-dense-mode
 duplex auto
 speed auto
 h323-gateway voip interface
!
interface GigabitEthernet0/0.90
 encapsulation dot1Q 90
 ip address 10.10.90.1 255.255.255.0
 ip pim sparse-dense-mode
!
interface GigabitEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.55
 encapsulation dot1Q 55
 ip address 172.29.1.4 255.255.255.0
 ip pim sparse-dense-mode

gi0/1 is the interface that will eventually be turned off as this is going to the old provider.

How can i make it so the tunnel handles all the traffic (including AP and Phone registrations)

Thank you for any help!

Improve this question
  • 1
    Are you trying to switch from L2 VPN to L3? Have you set the required static routes or a routing protocol between sites? Do you require renumbering? Registering remote devices may require a local DHCP server or relaying. – Zac67 Jul 9 '20 at 14:50
  • we dont have too large of a routing table so adding static routes isn't an administrative burden. however i tried adding a routes on our core switch as well as the site_A router. I'm unable to ping from the core switch to the tunnel IP i have set. – ptabs Jul 9 '20 at 15:02
  • Then either the route (or backroute!) isn't working or the gateways are filtering. – Zac67 Jul 9 '20 at 15:07
  • Is the Tunnel4 interface UP? Can you ping across that tunnel to the remote site? If the interface is down its IP 172.31.1.1 shouldn't be ping-able IIRC. – Jeff Wheeler Jul 9 '20 at 15:30
  • the tunnel 4 interface is actually up on both the cisco router and the fortigate side. however when sourcing a ping to any address on the main campus I cannot ping across. I've even tried adding static routes to the 172.31.0.0 /16 network on the core and upstream devices with no success. – ptabs Jul 9 '20 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.