FortiClient - Access to HQ and Branch

Probably about every month, this same question pops up at the forum, although it's hard to search since people use different terms to describe the same thing.

By assuming it's a dialup IPsec or tunnel mode SSL VPN from the Forticlient(FC), yes, of course it's possible. It works just like "hub and spoke" arrangement. You need to take care of three things:

1) routing from/to the FC client source IP to/from the destination IP at the branch on the other side of site-to-site VPN, including split tunnel at the client if it's split.

2) Pase2 selectors on the site-to-site need to cover the source/destination combinations above.

3) policies on botrh FGTs allow the traffic