Permit traffic from vpn ( ipsec client to site ) to ( ipsec site to site ) over specific ip

Question

Hello guys, I have two fortigates whit a vpn site to site stablished ( 192.168.88.0/24 local address in site 1 and 192.168.115.0/24 in site 2 ) this is up. Ok, now in site 2 I have permited only specific ips 192.168.88.13-14-15 to connect to 192.168.115.0, no more. This is ok, ping and other services, for example 192.168.88.13 -----> 192.168.115.163 ping up in site to site.

Also I have a vpn client to site IPSEC whit forticlient to some remote users in the ip range ( dhcp vpn ) 192.168.88.201-250 over site 1.

I wish that a remote user for example whit ip 192.168.88.210 to reach the ip 192.168.115.163 in the site 2 but only with the ips mentioned above 192.168.88.13-14-15

SQUEMATIC

Remote user ( 192.168.88.210 client to site)------>FG1----------Mapped(192.168.88.13)>(site to site IPSEC) -------> FG2 ------ >Server (192.168.115.163)

What is the step by step? Thanks for your reply.

npariyar · Accepted Answer

In this case, create an IP pool for the IP range 192.168.88.13-192.168.88.15

config firewall ippool
edit "Test"
set startip 192.168.88.13
set endip 192.168.88.15
next
end

Then enable nat on the firewall policy (SSL to IPSec VPN ) and choose an ip pool (Here Test)

Eg:

config firewall policy
edit 9
set uuid a7ba2344-424f-51ee-83df-e5e2b419acc3
set srcintf "ssl.root"
set dstintf "overlay-br-port1"
set action accept
set srcaddr "all"
set dstaddr "192.168.115.0"
set schedule "always"
set service "ALL"
set nat enable
set ippool enable
set poolname "192.168.0.0/24"
set users "fortinet"
next
end

sbabu · Answer

HI,

Please let me know if my understanding of your query is correct.

the remote user from IP 192.168.88.210 should be mapped to 192.168.88.13 in site1 first and then that traffic should reach to site2 and then forwards to 192.168.115.163

If my above understanding is correct then try to follow the below process.
create a VIP on FG1 when traffic with destination to 192.168.88.13 (port no) then it should forward to 192.168.115.163 (port no)

If proxy-id is used in FG2 VPN setup, then please add 192.168.88.0 subnet.

refer the below article for VIP config.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

Sign up

Login with SSO

Login to the community

Login with SSO