Overlapping ip addresses over IPSec VPN

Hello Forti_tude,

You can use VIP (DNAT) object on site Z. For example; 

Site Z Conf: 

VIP Object(DNAT): 10.10.20.10 -> 10.10.10.10

S2S Phase 2 Conf: 

remote subnet: 10.10.10.10

local subnet: 10.10.20.10

Site X Conf: 

S2S Phase 2 Conf : 

Local Subnet: 10.10.10.10

Remote Subnet: 10.10.20.10 

After this configuration. Site Z should access to the application with a new nat IP.

Btw if traffic also initiates from site Z. You should also do nat configuration on site X.  If they not, this configuration should be enough. Because Fortigate will not control routing information for return traffic.

Below URL explains this scenario.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/426761/site-to-site-vpn-with-overlapping-subnets

Thanks ozkanaltas and srajeswaran.

Please note that there is no direct IPSec S2S vpn between site_X and site_Z.

They just happen to both have an IPSec S2S VPN each to site_Y.

Do your suggestions still apply?

Thank you and regards,

fort_tude

Hello forti_tude,

You can still apply this solution. But be careful at determining new nat IP address. This IP address should not used on sites X,Y and Z. 

Site Z Conf: 

VIP Object(DNAT): 10.10.20.10 -> 10.10.10.10

S2S Phase 2 Conf: 

remote subnet: 10.10.10.10

local subnet: 10.10.20.10

Site Y Conf: 

Static route or policy route: 

DST: 10.10.10.10

Interface: Tunnel X

---------

DST: 10.10.20.10

Interface: Tunnel Z

S2S Phase 2 Conf on between X and Y tunnel: 

remote subnet: 10.10.10.10

local subnet: 10.10.20.10

S2S Phase 2 Conf on between Y and Z tunnel: 

remote subnet: 10.10.20.10

local subnet:10.10.10.10

Site X Conf: 

S2S Phase 2 Conf : 

Local Subnet: 10.10.10.10

Remote Subnet: 10.10.20.10