Skip to main content
Fabio74
Fabio74
New Member
February 21, 2023
Question

Site To SIte

  • February 21, 2023
  • 8 replies
  • 6681 views

Good evening everyone. I have a question, if it is possible to realize this scene.

We have 2 sites (AeB) in ipvsec vpn. the first site A has class 192.168.0.0 the second B has class 192.168.1.0. In the first site we have another class 192.168.2.0 configured on port2 of the firewall. Is it possible to reach class 192.168.2.0 from Site B?

8 replies

A
Anonymous_User
Contributor
February 21, 2023

If with the class you're referring to the overlapping subnet on both the sites then yes you can configure VIP and NAT to achieve this, follow the below link:

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/426761/site-to-site-vpn-with-overlapping-subnets


Also, by default FortiGate will not allow you to configure an overlapping subnet on Interfaces. Check the below guide. 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-subnet-overlap-to-set-IP-addresses-of/ta-p/191639

Fabio74
Fabio74Author
New Member
February 22, 2023

Hello and thank you very much for your reply. Indeed it is as I thought, in the sense that in site A I created a Policy with NAT to put the two network classes in communication. But it does not work

Fabio74
Fabio74Author
New Member
February 22, 2023

But perhaps I have not expressed correctly what is happening. I insert a drawing of the situation

 

Fabio74_1-1677056839535.png

 

aionescu
Staff
aionescu
Staff
February 22, 2023

Hi @Fabio74,

 

Just to clarify on FGT A you have two ports with 192.168.1.0 and 192.168.10.0 and you want to reach, over IPsec 192.168.40.0 who resides behind FGT B. Is that correct?

If it is the case, how does the phase2 looks like? Are there policies that allow the traffic, Are there routes pointing towards those subnets over the tunnel interface?

Fabio74
Fabio74Author
New Member
February 22, 2023

HI aionescu
Absolutely correct what you say. You understood perfectly. Phase two is 0.0.0.0/24 in local and in remote

Thank

Fabio74
Fabio74Author
New Member
February 22, 2023

Consider that the two fortigates A and B communicate perfectly. Even the PCs between them. The class 192.168.10.0 I'm inserting now for need

gfleming
Staff
gfleming
Staff
February 23, 2023

You talk about using class A and B address space (which isn't really in use these days) and your diagram shows you are using Classless Interdomain Routing (CIDR) Notation on your subnets.


Can you confirm your subnets are all /24? That is all hosts are using 255.255.255.0 masks, including the FortiGate interfaces?

Fabio74
Fabio74Author
New Member
February 23, 2023

Hi Gfleming, yes yes, I confirm that they are all /24 . A and B work regularly from 192.168.1.0 to 192.168.40.0. But the class 192.168.10.0 to 192.168.40.0, nothing, it doesn't work. Thank

gfleming
Staff
gfleming
Staff
February 23, 2023

Do you have a Firewall Policy that allows traffic from port2 to the IPSec tunnel?

IndianKid
IndianKid
Visitor III
February 23, 2023

Hi Fabio,

 

Yes, You can reach Site A to Site B and Site B to Site A.

while configuring VPN, make sure on-site A you added both networks 192.168.0.0/24 and 192.168.2.0/24 in the VPN source address and Add the same subnets in Site B Vpn Destination network. so from Site B, you can reach both sites A networks.

Fabio74
Fabio74Author
New Member
February 23, 2023

Hello and thanks. I added the static routes on A to B. On B for the moment there is actually only one static route or the main one, do I also add the second always from site A?

aionescu
Staff
aionescu
Staff
February 23, 2023

I am not sure I understand your configuration but, on both firewalls you need to have routes towards each network. So, on B you would need routes towards both subnets that are behind firewall A.

mgoswami
Staff
mgoswami
Staff
February 24, 2023

Please execute the below commands and see if you are seeing any packets.

diag sniffer packet any 'host 192.168.10.0 and host 192.168.40.x and icmp' 4 0 a

Initiate a ping form the 10.0 towards 40.x post this.
Replace x with the remote subnet PC's IP.
Also do a tracert from your Local PC to the remote gateway to see where is the packet dropping.

Fabio74
Fabio74Author
New Member
February 27, 2023

Hi everyone. First I want to thank everyone for your suggestions. The problem is solved. Actually the problem was on the Static Route in the recreated site B. everything worked

 

Grazie ancora !!!!

Terms & ConditionsAccessibility statement