The Route-Based VPN is not working, even though Phase 1 and 2 negotiations are complete. A route is required to reach a remote network across a site-to-site VPN via a tunnel interface. Confirm a route has been created to the tunnel interface for the VPN.
Make sure to provide a route to the destination VPN network through the tunnel interface associated with the VPN .
Example:
Two sites with SSG140 at each end. One site has the internal network address as 192.168.1.0. The remote network address is 10.1.1.0:
At Site A:
- Create a tunnel interface. The VPN traffic will be routed via this tunnel interface.
- A static route has to be added, so that the firewall will know how to route the packet that is destined for the 10.1.1.0/24 network.
At Site B:
Similarly, for the traffic that is initiated from the remote end and is arriving on the 192.168.1.0/24 network:
- Create a tunnel interface (for example, tunnel.2). The VPN traffic will be routed via this tunnel interface
- A static route has to be added, so that the firewall will know how to route the packet that is destined for the 192.168.1.0/24 network.
For Site A (via the WebUI):
- Go to Network > Routing > Destination (or Routing Entries).
- Select the appropriate Virtual Router.
- Click New.
- Network Address: 10.1.1.0
- Netmask: 255.255.255.0
- Click the Gateway button.
- Interface: tunnel.1
- Gateway IP Address: IP address of Internet router
- Click OK.
Via the CLI:
set vrouter trust-vr route 10.1.1.0/24 interface tunnel.1 [Enter]
For Site B (via the WebUI):
- Go to Network > Routing > Destination (or Routing Entries).
- Select the appropriate Virtual Router.
- Click New
- Network Address: 192.168.1.0
- Netmask: 255.255.255.0
- Click theGateway button.
- Interface: tunnel.2
- Gateway IP Address: IP address of Internet router
- Click OK.
Via the CLI:
set vrouter trust-vr route 192.168.1.0/24 interface tunnel.2
[Enter]
To verify the route, refer to
KB4435 - How Do I Verify a Route to the Virtual Router?
2017-12-07: Article reviewed for accuracy. Removed mention of End of Life devices. Article is correct and complete.