search

fortinet-solutions-cse / sdwan-advpn-reference

Jinja Orchestrator for Fortinet SD-WAN/ADVPN
53 stars 12 forks source link

support underlay loopback (src_ip for local-out traffic) #22

Closed dmitryperets closed 10 months ago

dmitryperets commented 10 months ago

Add support for an optional parameter src_ip in the profile interfaces, for example:

    'DualISP': {
      'interfaces': [
        {
          'name': 'port1',
          'role': 'wan',
          'ol_type': 'ISP1',
          'ip': 'dhcp',
          'src_ip': isp1_lo,      <<<<<
          'dia': true
        },

When configured, this source IP is expected to be used for all the local-out (outgoing) traffic from this interface. What concerns Jinja, this means for example, that the overlay IPSEC tunnels will be terminated on this IP (thanks to set local-gw in the tunnel configuration).

The implementation will create a new loopback interface called Lo-wan<index> (e.g. Lo-wan1) with this IP. The format is the same as for ip (thus including the mask, e.g. "1.2.3.4/32").

NOTE: For the correct ADVPN operation, a firewall policy is required on the Spokes, to permit incoming traffic from the WAN interfaces to the new Lo-wan<*> interface. This is a standard FOS requirement for traffic destined to the loopback interfaces.