NAT packets through ipsec tunnel

Forum|Forum|9 years ago
June 24, 2017
4 replies
6235 views

Hello ;) , this is my first post and I need some help with configuration. I will try to quickly explain:

On Fortigate1 there is LAN 10.12.0.0/16. Fortigate2 has 10.17.17.0/24 LAN (port1) FGT1 & FGT2 are connected via a IPSec VPN connection and on FGT2 I have second subnet on port2 (192.168.40.0/24) What policy I must add to route traffic from 192.168.40.0/24 to the remote LAN (10.12.0.0/16) on Fortigate1 ? I want to go out from LAN 192.168.40.0/24 on FG2 as IP from pool 10.17.17.0/24 and then into the tunnel to reach LAN 10.12.0.0/16 on FG1. I tried add NAT rule (on FG2) from LAN-192.168.40.0/24 to IPSEC TUNNEL INTERFACE but it's not working. Perhaps because it already exists rule to NAT 192.168.40.0/24 to WAN interface on FG2. P.S. I don't wanna change tunnel addresses on both sides. Users from 192.168.40.0/24 must ping 10.12.0.0/16 addresses without adding static routes on theirs PC.

Please help!

Thanks a lot!

Mike

EMES

New Member

Using an IP pool should work, can you show us what you've configured.

mdfAuthor

New Member

Eugene.milon wrote:
Using an IP pool should work, can you show us what you've configured.

Thanks for reply. Here's my config:

Fortigate1: vdom-root wan1 2.2.2.30/24 lan ip 10.12.0.100/24 255.0.0.0 Policy:

#1

srcintf "lan" dstintf "wan1" srcaddr "all" dstaddr "all" action accept schedule "always" service "ALL" nat enable #2 srcintf "lan" dstintf "vpn-1" srcaddr "vpn-1_local" dstaddr "vpn-1_remote" action accept schedule "always" service "ALL" #3 srcintf "vpn-1" dstintf "lan" srcaddr "vpn-1_remote" dstaddr "vpn-1_local" action accept schedule "always" service "ALL" router static gateway 2.2.2.20 device "wan1" dst 10.17.17.0 255.255.255.0 device "vpn-1"

"vpn-1_local" 10.12.0.0 255.255.0.0 "vpn-1_remote" 10.17.17.0 255.255.255.0 Fortigate2: vdom-root wan1 1.1.1.28/24 lan ip 10.17.17.100/24 255.255.255.0 Policy:

#1 srcintf "lan" dstintf "wan1" srcaddr "all" dstaddr "all" action accept schedule "always" service "ALL" nat enable #2 srcintf "lan" dstintf "vpn-1" srcaddr "vpn-1_local" dstaddr "vpn-1_remote" action accept schedule "always" service "ALL" #3 srcintf "vpn-1" dstintf "lan" srcaddr "vpn-1_remote" dstaddr "vpn-1_local" action accept schedule "always" service "ALL" router static gateway 1.1.1.25 device "wan1" dst 10.12.0.0 255.255.0.0 device "vpn-1"

"vpn-1_local" 10.17.17.0 255.255.255.0 "vpn-1_remote" 10.12.0.0 255.255.0.0 vdom-lan LAN-192.168.40.100/24 wan2 1.1.1.29/24 firewall policy #1 srcintf "LAN" dstintf "wan2" srcaddr "all" dstaddr "all" action accept schedule "always" service "ALL" nat enable IPSEC Site-to-site configured as standard without NAT traversal.

EMES

New Member

It looks like you have two VDOMs on FGT2. You need to route the traffic across the VDOMs first using VDOM links. When you seperate the firewall logically then the two vdoms dont know anything about each other. The following article should help http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-virtual-domains-54/4-Inter-VDOM-routing/7-Example-configuration.htm . You would then create the following IP Pool and then add a policy for vdom link to vpn1 on FGT2-vdom root. you will also need policies allowing lan to vdom link on fgt2 vdom LAN. Its a little more complicated with multiple VDOMS.

config firewall ippool

edit "IPsec NAT"

set startip <unused IP in 10.17.17.0/24>

set endip <same IP as above>

srcintf "lan" dstintf "vpn-1" srcaddr "192.168." dstaddr "vpn-1_remote" action accept schedule "always" service "ALL"

Sign up

Login with SSO

Login to the community

Login with SSO