Skip to main content
osaleem2_10
osaleem2_10
Explorer III
March 7, 2025
Question

Ipsec vpn hub and spoke

  • March 7, 2025
  • 3 replies
  • 1535 views

Hi,

 

I have HQ with 2 WAN Int, one is a public IP, and 4 branches as Spokes with no public IP.

 

I have built SD-WAN in my HQ to do Load sharing. Now I want to let the spokes connect with the HQ to reach some services.

 

1- is the right VPN dial-up hub and spoke?

2- should I build a VPN from SD-WAN wizard, or no need I can build it as normal from a VPN IPsec tunnel?

3- If I want spokes to communicate with each other, what should I do extra? is it only add routing and security policy? or do I have to change the VPN type?

3 replies

Anthony_E
Staff
Anthony_E
Staff
March 10, 2025

Hello Osaleem,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
    Anthony_E
    Staff
    Anthony_E
    Staff
    March 13, 2025

    Hello,

     

    We are still looking for someone to help you.

    We will come back to you ASAP.


    Thanks,

    Best Regards
    Anthony_E
    Staff
    Anthony_E
    Staff
    March 14, 2025

    To set up an IPsec VPN in a hub-and-spoke configuration, :

    1. Network Topology: Identify the central device (Hub) and remote devices (Spokes).  Ensure the hub is connected to the Internet and each spoke connects to the hub through the Internet.
    2. Hub Configuration: Configure the FortiGate unit as the hub. Set up IPsec VPN tunnels for each spoke. Use preshared keys for authentication. Define a VPN concentrator to manage the spokes.
    3. Spoke Configuration: For each spoke, configure phase 1 and phase 2 settings to establish a VPN tunnel with the hub. Set source and destination addresses for the networks behind the spokes and the hub. Create firewall encryption policies to enable communication between the spokes and the hub.
    4. VPN Tunnel Management: Ensure all VPN tunnels terminate at the hub. Manage traffic between spokes through the hub.
    5. Testing and Verification: Verify the VPN connections are established and functioning correctly. Test communication between the hub and each spoke, as well as between spokes if required.
    Best Regards
      Terms & ConditionsAccessibility statement