Setup routing between to sepearte sites

[Private Citizen]

The title should've read:
Setup routing between two seperate sites:

Hey guys. I've got this issue that I've really gone in circles with. I'm about to pull out my hair. If anyone has any advice on the issue below I would greatly appreciate.

Currently I have a IPSEC VPN connection setup between site1 and site2. Everything works fine 98% of the time however it does eat up some bandwidth on our main line and we do have a dedicated Point to Point line we pay for (P2P). The current setup can be seen in the first graphic.

My goal is to connect site1 and site2 together using the 2Mb dedicated line we pay for from our ISP. I initially tired to setup this connection however something was wrong with my config and I couldn't get it to work on that day and I shelved it until I could get the time to revisit which is now. I basically need to connect both LAN together since all the servers are at site2. The graphic below illustrates what the connection will look like in the end with the P2P line in use.

Basically my initial config for the site to site P2P connection was the following.

Site1 - FG-110C:
Port1 = LAN (192.168.7.1)
Port2 = P2P Connection (192.168.9.2)
Port3 = INTERNET

Site2 = FG-300A:
Port1 = LAN (192.168.0.1)
Port2 = P2P Connection (192.168.9.1)
Port3= INTERNET

Then I created a policy on each Fortigate that said Port1 to Port2 Allow ANY and Port2 to Port1 Allow ANY. I also needed to setup a static route but cannot remember what I put. I feel the problem is in the static route setting. Does anyone have any advice on the config? I setup multiple variations of the config but I never could get the connection to work between the two sites. I cannot ping PORT2=192.168.9.2 from site 1 let alone ping anything in the PORT1=192.168.0.0 network.

Going by what the setup is does anyone have a reccomendation on what the static routes would look like on both ends. I've tried many combinations with no success. Like I typed above, I have already created the appropriate firewall policies to allow traffic between the two ports, I just need to get the routing worked out.
=================================================================
Just a side note; the P2P line does work indeed. If I take both ends of the P2P connection and plug them into one of the LAN switches on both ends, traffic flows. So the P2P connection does work. I've also connected a laptop at site1 directly to the ONT on the wall in the P2P port and I can ping site 2's PORT2 interface and then added a static route on the laptop and I can ping the PORT1=192.168.0.0 also. Just cannot do it with both firewalls connected.

 

[Shockey]

Site one static route.( going to site 2 LAN)

192.168.0.1 through site 2 p2p port(192.168.9.1)

Site Two: (going to Site 1 LAN)

192.168.7.1 through site 1 p2p port(192.168.9.2)


This is a guess as i only done static routes through cisco academy packet tracer. From what i recall that how i always did them from router to router.

Your results may vary.

 

[mattjw916]

Site 1 routes:

route 0.0.0.0 0.0.0.0 --> Internet gateway address
route 192.168.0.0 255.255.255.0 --> gateway 192.168.9.1

Site 2 routes:

route 0.0.0.0 0.0.0.0 --> Internet gateway address
route 192.168.7.0 255.255.255.0 --> gateway 192.168.9.2

 

[Private Citizen]

I finally got the issue resolved.

Site 1 routes:

route 0.0.0.0 0.0.0.0 --> Internet gateway address
route 192.168.0.0 255.255.255.0 --> gateway 192.168.9.2

Site 2 routes:

route 0.0.0.0 0.0.0.0 --> Internet gateway address
route 192.168.7.0 255.255.255.0 --> gateway 192.168.9.1

My error came from the fact that on the Fortigate units you have to specify which interface you want the static route to be used for. I was selecting what I felt was the logical choice but I was wrong.

Thanks for the responses from everyone. Matt your response ensured me that I wasn't going crazy and that my static routes were on the right track I just had to flip the gateways around.

 

[mattjw916]

Yeup, that's another way to do it. Glad it worked out for you.