Skip to main content
Duncan
Duncan
New Member
October 28, 2019
Question

Multiple local subnet interfaces for IPsec VPN

  • October 28, 2019
  • 1 reply
  • 3039 views

We have two FortiGates (100E & 200E) that we want to establish a VPN between. Both firewalls have a local VLANs configured (via FortiLink managed FortiSwitches). We want all VLANs communicate over the VPN.

When using the FG-FG VPN wizard, I have noticed I am required to choose a local subnet interface. In our case we want all our VLANs but this is not possible in the wizard.

What would you recommend? Perhaps I could create a zone but this would require I recreate all our firewall policies. Is this the preferred way?

Or maybe I should create the VPN using the custom wizard. I can't see a requirement for a local interface.

Cheers.

Dunc

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
October 28, 2019

I don't regularly use wizard/GUI but if you create a site-to-site for FGTs even when you specify 0.0.0.0/0 for source and destination it seems to set "addr-type" to "name" instead of 0/0<->0/0.

Then you need to go to "custom", then the default selector set is 0/0<->0/0 so you don't have to change it. You just need to set proper routes and policies on both sides to allow all vlans to talk between them.

Duncan
DuncanAuthor
New Member
October 29, 2019

Thanks mate.

Got the test scope going via the GUI custom wizard. I will do some performance testing before using for production traffic.

Terms & ConditionsAccessibility statement