Skip to main content
rharrison
rharrison
New Member
May 10, 2019
Solved

Routing between two routers behind NAT via a non NAT router

  • May 10, 2019
  • 2 replies
  • 3463 views

I have two networks 172.20.1.0/24 & 172.20.2.0/24 both behind NAT routers with 60E's connected to those routers. I have configured SITE to SITE ipsec for the corporate network on a static IP 100D routing  172.18.0.0/16 for both SITES and this works fine.

 

But now I would like to ping SITE 1 172.20.1.1 from SITE 2 172.20.2.1 and I'm not sure if I can config something up on the PHASE2 connectors at each site to allow the packets to flow between the two NATed routers via the static IP Router. 

 

See diagram attached

    Best answer by Dai
    Hi. Follow the steps below to check if a packet can be received by the device. <Configured on each device> Trusted Host 172.20.1.0 / 255.255.255.0 Trusted Host 172.20.2.0 / 255.255.255.0 [link]https://kb.fortinet.com/k...nk.do?externalID=10868[/link] <SITE 2 Fortigate> Firstly make sure you are not pinging 172.20.1.1 <SITE 1 Fortigate> Connect to the FortiGate CLI then type the following commands:   diag debug flow filter saddr 172.20.2.1 diag debug flow show console enable diag debug enable diag debug flow trace start 10 <SITE 2 Fortigate> Once this is done start pinging 172.20.1.1 Observe the FortiGate CLI output. 1) what route/interface the packets match. 2) what policy it hit.

    2 replies

    Dai
    DaiAnswer
    Explorer II
    May 13, 2019
    Hi. Follow the steps below to check if a packet can be received by the device. <Configured on each device> Trusted Host 172.20.1.0 / 255.255.255.0 Trusted Host 172.20.2.0 / 255.255.255.0 [link]https://kb.fortinet.com/k...nk.do?externalID=10868[/link] <SITE 2 Fortigate> Firstly make sure you are not pinging 172.20.1.1 <SITE 1 Fortigate> Connect to the FortiGate CLI then type the following commands:   diag debug flow filter saddr 172.20.2.1 diag debug flow show console enable diag debug enable diag debug flow trace start 10 <SITE 2 Fortigate> Once this is done start pinging 172.20.1.1 Observe the FortiGate CLI output. 1) what route/interface the packets match. 2) what policy it hit.
    rharrison
    rharrisonAuthor
    New Member
    May 14, 2019

    Thanks for this Dai

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!