Environment: A company network has a Firebox M-series appliance with Total Security Suite at headquarters. Every branch office has a smaller T-series Firebox without subscription services. For this reason, all traffic from the branch offices is routed through the M-series appliance at headquarters. Some of the branch office Fireboxes has a static IP, some obtains it via DHCP.
Occasionally there might be some problems with the tunnel (for example if the HQ network is down). Therefore, the branch office Fireboxes need to be able to abandon the 0.0.0.0/0
route through the tunnel and work standalone for a while, since BO Internet connectivity is crucial for the business. This works with BO Virtual Interface, but not with 0.0.0.0/0
over BO GW & Tunnel.
Simplified (just one External and Trusted if) related configuration, a branch office with DHCP.
- Firebox-HQ (
10.9.0.1
) - M670 [Fireware OS v12.2.1.B572649]- Interfaces (Routed Mode)
eth0
: ISP1 [External] -198.51.100.123/24
(Static)eth1
: Trusted [Trusted] -10.9.0.1/24
- VPN Interface (
bvpn20
): BovpnVif.BO20 [IKEv1]- Route to
10.9.20.0/24
- Route to
- Interfaces (Routed Mode)
- Firebox-BO20 (
10.9.20.1
) - T55 [Fireware OS v12.2.1.B572649]- Interfaces (Routed Mode)
- DNS Servers:
192.0.2.10
&192.0.2.20
(ISP2's DNS servers) eth0
: ISP2 [External] -203.0.113.33/24
(DHCP)eth1
: Trusted [Trusted] -10.9.20.1/24
- DNS Servers:
- VPN Interface (
bvpn1
): BovpnVif.HQ [IKEv1]- Route to
0.0.0.0/0
- VPN Settings: [x] Remove VPN routes when the tunnel for a BOVPN vif is down.
- Route to
- Interfaces (Routed Mode)
Everything works just as expected when the tunnel is down. The Firebox-BO20 can work as a DNS resolver for its eth1
network. Both 10.9.20.0/24
and Firebox itself can access the Internet.
Problem: When the tunnel is up and the 0.0.0.0/0
route through bvpn1
is added, the clients on eth1
can access the Internet through the VPN and all the resources (incl. DNS servers) at the HQ.
IPv4 Routes
------------
Destination Gateway Genmask Flags Metric Interface
0.0.0.0 0.0.0.0 0.0.0.0 U 1 bvpn1
0.0.0.0 203.0.113.1 0.0.0.0 UG 5 eth0
10.9.20.0 0.0.0.0 255.255.255.0 U 0 eth1
203.0.113.0 0.0.0.0 255.255.255.0 U 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 lo
However, Firebox stops working as a DNS resolver and loses its own Internet connectivity. This is due to the fact that Firebox own connections starts to use the route, too.
- The ISP2's DNS servers
192.0.2.10
&192.0.2.20
aren't accessible from ISP1. - The devices on network
10.9.20.0/24
can access the Internet throughbvpn1
. - Firebox doesn't use its internal IP
10.9.20.1
through the tunnel, but203.0.113.33
. - The Firewall rule
Any From Firebox-00
is hard-coded and doesn't show up in Policy Manager. Otherwise it would have been easy to force it to useeth0
with<policy-routing>
.
There are firewall policies to allow all the necessary traffic on both appliances; the problem is therefore delimited to the routing, alone.