Visitor III

Question

site-to-site tunnel with multiple subnets

11 replies
4086 views

Hello Everyone,

According to article 197368 "Technical Tip: How to configure VPN for multiple subnets "
It is necessary to only configure one (1) subnet per Phase 2 tunnel..

In my case that becomes very difficult because I have tunnels with more than 20 subnets (source as destination).
I wonder if Is it possible to use "Named Address" objects with multiple subnets as members?

Kind regrads,

Homan

FortiGate

abarushka

Staff

Hello Homan,

You may consider to use address group (local address and remote address) in phase 2 configuration:

https://docs.fortinet.com/document/fortigate-6000/5.6.12/fortigate-6000-handbook/202963/adding-source-and-destination-subnets-to-ipsec-vpn-phase-2-configurations

HomanAuthor

Visitor III

Hello abarushka,
Thank you for the reply.
I will try it.
Kind regards,
Homan

HomanAuthor

Visitor III

Hello,

Here I am again. That took a while, but we tested the named address option instead of separate subnets. That works perfectly.

But everywhere we have a named address with multiple subnets we see a down entry on phase 2 selector.
An SA entry is made for each subnet, but there is also a SA entry for all subnets in the named address. The SA entry with with all subnets is down in the phase2 selector.

Is this a normal behavior?

kind regards,

Homan

sw2090

SuperUser

you could also set the p2 selector to 0.0.0.0/0.0.0.0 and do the rest with routing and policies.

HomanAuthor

Visitor III

Hello sw2090,
Thank you for the reply.
Yes it is possible but because of company policy I am not allowed to use 0.0.0.0/0.0.0.0 for my VPN connections.

Kind regards,
Homan

sw2090

SuperUser

well the you could either do one p2 selector per subnet or do one p2 selector and use an address-group in there.

parteeksharma

Staff

Hi Homan,
You can use address-group in the phase2 selectors config and create the policies and routes for interesting traffic to flow through the IPsec vpn.

Regards,
Parteek

HomanAuthor

Visitor III

Hello parteksharma
thanks for your reply.
I will test with address-group next week.

Kind regrads,

Homan

ede_pfau

SuperUser

Just a hint: if you use an address group, you could use the same address group both in the policy and in a static route pointing to the tunnel. As a prerequisite, each address must be marked as "routeable". If all addresses are routeable, then the address group is as well.

If the option to make an address routeable is greyed out, add it in CLI:

set allow-routing enable

HomanAuthor

Visitor III

Hi Ede,

Thank you for the replay, do you mean the Static route configuration option in address group properties?

Kind regrads,

Homan

ede_pfau

SuperUser

Yes.

Sign up

Login with SSO

Login to the community

Login with SSO