Bridging / layer2 vpn

Hi, I dont think its possible as you describe it, i have searched for this as well. But there is a way to allow a few addresses from the same subnet to be on both sides, and its transparent. the word to search for is " proxy-arp" at kb.fortinet.com

What you will need is a l2 MPLS VPN or L2tpv3, neither are supported within the fortigate or any other firewall that I can think of. What are you trying to accomplished or achieve with bridging over to networks? Do you have network overlaps ?

you can create a VPN between 2 Fortigate (vdoms) in transparant mode using policy based VPN. That' ll do the trick.

Eric: is that possible ? i been searching for a way to do this.. so the same subnet can be on both sides of the VPN tunnel ? (same broadcast domain)

Can you elaborate a little more on the high level concept of a transparent mode VPN? Would broadcast traffic (including ARP) traverse? To answer the earlier question, there is a building on the property that cannot be reached via wire or wireless without extreme cost due to environmental constraints. However, cable/dsl already reaches the other building. Due to the very small number of clients, the desire is to logically extend the needed networks using the concept of bridges if at all possible. Yes, I do think MPLS would do the trick but that doesn' t seem to be an option. I' m toying with the idea of OpenVPN in " tap" mode but there' s certain drawbacks too. In the end, I may have to give up and use traditional layer 3 routed segments. It' s too bad the Fortigate soft switch cannot add IPsec interfaces as members. Thanks for the thoughts thus far!

Nope, sorry missed the part that both subnets should be the same. you can do nat on this, but that probably won' t meet the requirement. I hope you' re not falling in the trap that some SAN supplier wants the same subnet for both for replication and failover purposes. From a network and security standpoint I won' t go for this. To subnets on the same subnet. It' s asking for problems. A recipe for disaster.

ditto Your best bet is to get out of bridging and make unique L3 subnets or NAT the remote network. if it' s a network that you own/admin, then re-address them and do it smarter & not harder.