Skip to main content
MsComX
MsComX
New Member
July 4, 2020
Question

Link two PCs over two Fortigates

  • July 4, 2020
  • 1 reply
  • 6065 views

Hi guys,

I want to link two PCs over two Fortigates through a VPN tunnel (cf. attachement)

Ws1 has to communicate with Ws3.

Ws1 is behind Fortigate1(60D) and Ws3 is connected to Fortigate2(60D) from another site by SSL VPN.

With the IPsec wizard, I have linked Ws1 and Ws2.

And with the SSL-VP Portal, I have linked Ws3 to Ws2.

Now I want an idea to link Ws1 to Ws3.

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    July 4, 2020

    I answered to an almost exact same question about a month ago, which I can't find it's just...

    SSL VPN client <--(SSL VPN)-->FGT<--(IPSecVPN)-->FGT<->host

    You need to take care of three things:

    1. routing from/to source to/from destination

    2. policies on the FGTs

    3. phase2 selectors for IPSec

     

    Depending on your SSL VPN setup the routing would vary. Let me ask you below:

    a. Is SSL VPN split-tunnel or non-split?

    b. Is the SSL VPN policies to allow destinations NATed or no NAT?

     

    MsComX
    MsComXAuthor
    New Member
    July 4, 2020

    Thank You Toshi for reacting.

    a) The SSL VPN is split-tunnel

    b) SSL VPN is gonna use a NAT translation

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    July 5, 2020

    Then, for the client routing, you have to set the destination subnet as a part of routing address at the portal. You should check the routing table on the client machine once it's done.

    If you use NAT for SSL VPN policy, the source IP for the packets go across the IPsec VPN use the tunnel interface IP. Make sure you configured the tunnel IP on both ends. Two /32 IPs work on both ends but generally recommended to pick ones in a /30 range, like 10.0.0.1/32 and 10.0.0.2/32. Then the other side of FGT knows where to route the returning packets.

     

    Probably you took care of sets of policies on both ends. Since you're NATing, it's one way access. So you need only one policy on each FGT.

     

    Then lastly make sure the phase2 selectors includes the access from the source tunnel IP, like 10.0.0.1/32, to the destination subnet.

     

     

    Terms & ConditionsAccessibility statement