Skip to main content
jasuncion808
jasuncion808
New Member
March 28, 2022
Question

Site-to-site access via remote VPN

  • March 28, 2022
  • 1 reply
  • 5349 views

Currently have two fortigate set up with site-to-site VPN. Each fortigate has its own Remote VPN profiles. We are able to RDP into each other's computer when on the office network, however I can't establish RDP sessions or access shared server resources from Site B to Site A, vice-versa.

 

Is it possible to set up a Remote VPN such that it can access both sites within one Remote VPN setup? As of right now, I have individual Remote VPN profiles set for reach site.

 

Not sure if this is possible or not. Or perhaps certain firewall policies need to be set such that one site can access different other site while Remote VPN?

 

1 reply

Markus_M
Staff & Editor
Markus_M
Staff & Editor
March 28, 2022

Hello,

 

First: number one is to define what VPN type is this. site-to-site says normally IPSec, but in later fortiOS versions s2s is also possible with SSLVPN. Setup is very different.

Second: Each FortiGate needs to have a set of static routes that will direct traffic for the other site through the tunnel interface. Be it forward traffic or return traffic.

Third: firewall policies on both FGTs are needed. For the originating traffic site, traffic from internal toward tunnel, for the destination site: traffic from the tunnel to the internal subnet.

If you consider those points, you will not need to consider symmetric setups etc. It is needed in some way, but it is better to consider the traffic that is supposed to flow in both directions.

 

Best regards,

 

Markus

jasuncion808
jasuncion808Author
New Member
March 29, 2022

Hi Markus,

 

Thank you for replying. Both sites are set as IPSec configuration. I'm a bit confused for the second and third item you listed. Sorry, I'm a bit new to the Fortigate and network configuration. Pretty much a novice.

Markus_M
Staff & Editor
Markus_M
Staff & Editor
March 31, 2022

Hi Jasuncion,

 

no problem. Both FortiGates will receive traffic, and they will need information in terms of a static route as to which destination traffic has to be led through the tunnel. Otherwise, the most fitting route will be the default route.

Traffic for 192.168.48.0/24 on the other end of a tunnel requires a static route to dst 192.168.48.0/24 with the interface of the tunnel. Otherwise, the traffic destined for 192.168.48.0 would leave the wan interface.

 

The IPsec tunnel wizard does a good job for this. It creates the routes and policies.

In case of IPSec you will also need to add the address networks of the other site you intent to reach as selectors.

 

This might help for some guide on how to set it up:

https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/281288/site-to-site-ipsec-vpn-with-two-fortigate-devices

 

Best regards,

 

Markus

Terms & ConditionsAccessibility statement