Routing with 3 fortigates IPSEC VPN!

Strange answers. This is not about an additional VPN but simple routing and policies.

To go from A to C, via B:

1. on FGT A:

- add a static route for the network C, gateway interface is the tunnel to B, no gateway address

- the tunnel between A and B should have 2 phase2's:

one from network A to network B

one from network A to network C (so this one needs to be added)

- in the policy from A to B, add network C's address range as destination address

2. on FGT C:

- add a static route for the network A, gateway interface is the tunnel to B, no gateway address

- the tunnel between C and B should have 2 phase2's:

one from network C to network B

one from network C to network A (so this one needs to be added)

- in the policy from C to B, add network A's address range as destination address

3. on FGT B:

- create 2 new policies:

   - from tunnel A to tunnel C

   - from tunnel C to tunnel A

with the correct source and destination addresses.

So, in short words, make sure the tunnel carries 2 destination networks (via 2 phase2's) and the policy allows the remote network. FGT B will do the routing, the transit traffic is allowed by 2 additional policies.

Let us know if this works for you.