Skip to main content
mavaje7896
New Member
March 31, 2022
Question

site-to-site IPsec VPN only allows 192.168.0.0/24

  • March 31, 2022
  • 1 reply
  • 1353 views

We established a site-to-site VPN that works, our traffic from 192.168.0.0/24 goes across this VPN to 172.16.24.0/24.

 

However, remote dial-up IPsec users now need access to this tunnel.

 

Our remote dial-up IPsec users are using 192.168.1.0/24, and when they attempt to access this tunnel, the remote peer denies it because it is not from 192.168.0.0/24.

 

How do I make the remote dial-in users 192.168.1.0/24 appear to be from our primary 192.168.0.0/24 network so that it is allowed to go across the VPN?

 

The VPN provider offers one subnet, I've asked them for a second, they said that's not an option.

 

Any advice or a point in the right direction would help, thanks you.

1 reply

akristof
Staff
Staff
April 1, 2022

Hello,

 

Thank you for your question. I see 2 ways how you can do it.

1) Create new phase2 on both devices to allow 192.168.1.0/24 to enter ipsec tunnel.

2) On firewall policy that is allowing traffic from Dialup tunnel to site2site tunnel enable NAT with ippool 192.168.0.0/24 (or some subset) and FortiGate will SNAT the traffic and it will be allowed to enter the tunnel.

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!