Skip to main content
mpcs
mpcs
New Member
June 23, 2022
Question

Mapping IP Addresses

  • June 23, 2022
  • 3 replies
  • 2807 views

Currently setting up a new VPN tunnel for a new application server.  What would be the best practice for mapping a new Ip range of 2.2.99.0 to the existing LAN of 192.168.99.0.  The tunnel has been created and is connecting; however, the vender cannot connect to the local devices.  The new server requires an Ip range of 2.2.99.0 and the current network is on 192.168.99.0.  What policies or methods should we be implementing??

3 replies

Anthony_E
Staff
Anthony_E
Staff
June 26, 2022

Hello mcpcs,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Best Regards
vponmuniraj
Staff
vponmuniraj
Staff
June 26, 2022

Hi,

 

Does the vendor need 192.168.99.0 to be source translated to 2.2.99.0? 

 

What does your current phase 2 configuration look like? 

 

Can you grab the output for the below? 

diag vpn tunnel list name <VPN name>

 

Regards,

mpcs
mpcsAuthor
New Member
June 28, 2022

Yes, and I have attached the phase 2 info.Fortinet Screenshot Phase 2.jpg

sw2090
SuperUser
sw2090
SuperUser
June 28, 2022

hm I have similar case here where I need to map vpn ips to a local subnet to make some service work over vpn that is limited to a specific subnet here.

 

I configured a s2s ipsec with split tunneling enabled and mode config enabled. So vpn clients get an ip from me and also get routes from me. 

I did not set any p2 selector (it is set to 0.0.0.0/0.0.0.0 hence there is split tunneling plus routing plus policies to limit access). 

I then created a policy that allows traffic from vpn subnet to the service subnet using snat with using an nat ip pool out of the local subnet. So vpn ips get snatted to local subnet when they try to access that service. Works fine here.

Terms & ConditionsAccessibility statement