IPSec Site To Site VPN

Hi,

Maybe this article would shed some light, https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-when-FortiGate-is-behind-NAT/ta-p/336494

Hi @yegget ,

If both FGTs can talk to each other via NATted IPs, yes.

For example:  

Site A has 192.168.10.1,  NATted IP 1.1.1.1

Site B has 10.10.10.1  NATed IP 2.2.2.2

In Phase1 settings:

Site A:  Local Gateway - 192.168.10.1  / Remote Gateway 2.2.2.2

Site B: Local Gateway - 10.10.10.1 / Remote Gateway 1.1.1.1

Enable Nat Traversal in phase 1 settings.

you can always look at the logs and analyze the traffic going over the tunnel and start weeding out traffic that you know you don’t want or look for traffic that you do want. Pretty vague, but it’s a start.