Am I able to create a static (blackhole) route to the SSLVPN subnet in order to advertised that subnet into BGP (by redistributing static into BGP) to the rest of the network?
I thought I was, however, when I created the blackhole static route, I lost connectivity to the firewall from SSLVPN, that got me thinking that as the name says, maybe the blackhole discard all traffic destined to whatever subnet I define there? Is that correct? if so, how could I possible advertised my SSLVPN subnet into BGP?
If not, then why I lost access to the firewall after creating that blackhole static route?
I use static blackhole routes for all RFC1918 subnets in all my routers but i give them 254 for the distance. If IPSec is up, blackhole route is not used, if IPSec is down, then blackhole route is next. Otherwise traffic will go to 0.0.0.0/0 and will not come back since that route will probably not be down.
Ahhh I got your point, yes, you basically make sure all the RFC1918 gets routed to the inside of your network if the actual route goes down, thank you for your answer. one quick question you are talking about actual routers or FortiGate FW?
On my home firewall, my SSL VPN address range is 10.212.134.200 - 10.212.134.210. Based on that, FortiOS sets the below kernel (FIB) routes (diag ip route list):
Note the priority (lower is more preferred). Also, these prefixes are kernel routes (so can be used for forwarding), but don’t appear in the routing table (RIB).
Add a blackhole for 10.212.134.200/29 and it looks like:
Note that the blackhole /29 (listed first) has a lower priority (more preferred than the SSLVPN-inserted prefix) and becomes more preferred - effectively blackholing your traffic. Playing around with it a bit, changing the distance on the prefix on the blackhole doesn’t adjust the priority in the kernel (FIB) table.
Add a static route with the next hop of your ssl.VDOM_NAME interface and it looks like above, but your “more preferred route” (that is now both in the RIB and FIB) still points to the SSLVPN interface.
That’s what I thought, I had never done this before on fortigate, I guess I tried to do the same thing I did with a Palo null route(which does not work that way), without properly understand the feature.
