Ipsec vpn tunnel for multiple networks

You have 2 means

1: change the  vpn to a route-based if not already and use the default 0.0.0.0/0:0 and just point destination routes for the networks to be reached over the vpn ( hQ to remote )  ( remote to HQ ) for the respective site

2: just create a 2nd phase2-interface and specifiy the 2nd set of networks using the same phase1-interface

config vpn ipsec phase2-interface

 edit "esa-p2-1"         set phase1name "sesa-main"         set src-subnet 10.10.80.0 255.255.255.0         set dst-subnet 192.168.25.0 255.255.255.0     next

 edit "esa-p2-2"         set phase1name "sesa-main"         set src-subnet 10.10.80.0 255.255.255.0         set dst-subnet 192.168.26.0 255.255.255.0     next

end

I like the later since you now have diagnostics for each set of proxy-ids with the diag vpn tunnel list command, so it helps to determine tx/rx-bytes sent per networks.

As usual and stated earlier, route-based vpns needs a "route" so in the 2 above I have a route to {192.168.25.0, 192.168.26.0 } networks

config router static

  edit 88

     set dst 192.168.25.0/24

      set device "sesa-main"

   next

  edit 89

     set dst 192.168.26.0/24

      set device "sesa-main"

   next

 end

Check out the fortinet cookbook for more tips , examples, or search in this support forum.