Skip to main content
GCJBL
New Member
September 7, 2018
Question

Routing across 3 (or more) subnets through a VPN tunnel?

All our offices are fortigates on 6.x firmware connected via IPSEC tunnels. Each office has its own unique LAN subnet, but also has a unique DHCP-based subnet strictly for wifi clients. NAT-based policy in each direction routes wifi clients back to the LAN in each office. All routing between offices is however using static routes with non-NAT policy in each direction over the IPSEC tunnels.

 

My dilemma: We are rolling out laptops to remote offices which have always previously been desktop endpoints strictly on LAN, so VPN tunnel routing always worked fine for LAN to LAN between two offices. Now that we are introducing laptops into the mix which will be on their own wifi subnet when undocked, I am having a hard time figuring out how to route through those 2 subnets back to a LAN subnet in another office. Since these other users have mapped drives on the LAN in our home office (remote to them), I am simply trying to figure out how to configure routing so that a laptop on the unique wifi subnet in our Northern office can get through to the LAN in our main office - which I assume is a route from localwifiSubnet -> localLANSubnet -> Remote Subnet.

 

I've read so much confusing information on this that I need help wrapping my head around how to do it properly in FortiOS. I have no problem making those wifi subnet policies static routes instead of NAT-based if that's a step in the right direction to facilitate a solution. Thanks profusely for assistance on this challenge. Hopefully I explained it well enough.

8 replies

Toshi_Esumi
SuperUser
SuperUser
September 8, 2018

Probably you read too many variations of articles, but you just need to pick up the common things.

- add Phase2 selectors to allow the 2nd (wifi) subnet to go over the vpn to get to the other side's subnet, if you're not using 0/0<->0/0 default selector.

- set proper routes (static or via routing protocol) on both sides to route to the tunnel interface.

- if policy set is limiting source/destination subnets, you need to add the new subnet to them.

That's all and it should take care of it.

ede_pfau
SuperUser
SuperUser
September 8, 2018

To make things easy:

- in VPN phase2, only use '0.0.0.0/0' as wildcard QM selectors. FortiOS explicitly allows this.

- in every location, create an address group containing your subnets in use, not only in local use but of HQ as well.

Use these in the policies allowing traffic to and from the VPN.

- put up static routes in every location, pointing the HQ subnet to the tunnel interface. You do not need to specify a gateway address (another speciality of FortiOS).

 

All in all these are only incremental changes to your existing config.

GCJBL
GCJBLAuthor
New Member
September 10, 2018

Ede and Esumi, thanks! Will try to digest this and come back with any questions. Much appreciated.

 

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT