Routing across 3 (or more) subnets through a VPN tunnel?
All our offices are fortigates on 6.x firmware connected via IPSEC tunnels. Each office has its own unique LAN subnet, but also has a unique DHCP-based subnet strictly for wifi clients. NAT-based policy in each direction routes wifi clients back to the LAN in each office. All routing between offices is however using static routes with non-NAT policy in each direction over the IPSEC tunnels.
My dilemma: We are rolling out laptops to remote offices which have always previously been desktop endpoints strictly on LAN, so VPN tunnel routing always worked fine for LAN to LAN between two offices. Now that we are introducing laptops into the mix which will be on their own wifi subnet when undocked, I am having a hard time figuring out how to route through those 2 subnets back to a LAN subnet in another office. Since these other users have mapped drives on the LAN in our home office (remote to them), I am simply trying to figure out how to configure routing so that a laptop on the unique wifi subnet in our Northern office can get through to the LAN in our main office - which I assume is a route from localwifiSubnet -> localLANSubnet -> Remote Subnet.
I've read so much confusing information on this that I need help wrapping my head around how to do it properly in FortiOS. I have no problem making those wifi subnet policies static routes instead of NAT-based if that's a step in the right direction to facilitate a solution. Thanks profusely for assistance on this challenge. Hopefully I explained it well enough.
