Skip to main content
ASPCORP
ASPCORP
New Member
October 19, 2016
Question

Allowing branch to connect to branch via Site to site Ipsec

  • October 19, 2016
  • 1 reply
  • 3064 views

We've created a Site to Site ipsec

 

HQ - 192.168.10.0/24

InternalRouter - 192.168.16.0/24

Branch "A"- 192.168.11.0/24

Branch "B" -192.168.12.0/24

 

 

How is it possible to have all subnets communicating with each other equally ?

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    October 20, 2016

    My first thought was to use supernetting - tunneling a 192.168.10.0/21 would cover 192.168.8 to 192.168.15. Won't work here, sigh. Your choice of network ranges is just a bit unfortunate.

     

    There are 2 ways to achieve connectivity:

    - create 2 tunnels, from A to HQ and from B to HQ. Set up routing so that you get from A to B. Allow destination subnet HQ from A, and subnet B from A; similar on B. For each subnet create a separate phase2. All in interface mode, of course

    - use the FortiOS wildcard '0.0.0.0/0' along with explicit routes to tunnel all possible subnets across.

     

    Instead of static routes, which I recommend, you could set up a dynamic routing protocol. Depends on you future plans - going from 2 to 3 spokes would certainly justify a protocol.

    Terms & ConditionsAccessibility statement