Skip to main content
Raffael_Hotz
New Member
September 26, 2018
Solved

multiple sites to one HQ with vpn

  • September 26, 2018
  • 3 replies
  • 4379 views

hello there,

 

I am wondering if it is possible to get multiple sites connected to one HQ with VPN. As i only see the Site-to-Site wizard, where you have to say what is the IP of the branche office, I am not sure how to do that. DO i just need to redo the same wizward, with the same local IP but different branche IP?

 

Thanks,

Raffael

Best answer by Toshi_Esumi

It's a very common variation of Site-to-Site, called "hub and spoke". When you search "Fortigate hub and spoke VPN configuration" on the internet, or in this Forum, you can find many examples including cookbook, online help, and KB.

In hub and spoke topology, you have to take care of phase2 traffic selectors and routing issues if you want to connect a remote site to another remote site via Hub/HQ to accommodate traffic not only between a remote to the HUB/HQ. Those examples show how. 

3 replies

Toshi_Esumi
SuperUser
SuperUser
September 26, 2018

It's a very common variation of Site-to-Site, called "hub and spoke". When you search "Fortigate hub and spoke VPN configuration" on the internet, or in this Forum, you can find many examples including cookbook, online help, and KB.

In hub and spoke topology, you have to take care of phase2 traffic selectors and routing issues if you want to connect a remote site to another remote site via Hub/HQ to accommodate traffic not only between a remote to the HUB/HQ. Those examples show how. 

Raffael_Hotz
New Member
September 26, 2018

Hi Toshi.

 

Thank you for your answer. That was what I am looking for. So for a centralized monitoring I don't need anything else than the Hub n Spoke configuration?

 

Thanks,

Raffa

Toshi_Esumi
SuperUser
SuperUser
September 26, 2018

Do you mean monitoring VPNs or devices at remote locations? For the former, logging at HQ FGT would tell you all events on all VPNs. For the latter, if you(or a monitoring device) are at the HQ, you should have access/reachability to each location over each "site-to-site" vpn. So you can monitor whatever you want to monitor.

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!