Site to site vpn between 2 FGTs

Forum|Forum|1 year ago
November 8, 2024
6 replies
2070 views

Hi

We want to setup site to site vpn between our fgt(200f) and our branch fgt (200e) . Hq fgt version is 7.6 and branch version is 6. We want to connect to only one server from branch and they will connect to one of servers too. In HQ, we have subnet overlapping when i want to insert remote ip but on the branch side they do not have any overlapping problem. How can i solve that?

FortiGate

hjezzapaula

Staff

Hi,

You may follow on below KB and just follow the VIP configuration on the peer with overlapping subnet.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-IPsec-tunnel-with-Overlapping/ta-p/242267

rezafathiAuthor

Explorer III

Thanks,

What is the difference between these two tutorials?

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/426761/site-to-site-vpn-with-overlapping-subnets&ved=2ahUKEwjn3ciBscyJAxXrhf0HHQ7LI1AQFnoECBcQAQ&usg=AOvVaw1s2O2WIhKDNd8FGsHW7M6s

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-IPsec-tunnel-with-Overlapping/ta-p/242267

kmohan

Staff

Hi Rezafathi
Both are same

Its a documentation from the Firmware Release Notes:
https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/426761/site-to-site-vpn-with-overlapping-subnets

It's a KB articles was created by one of Technical Engineer, and tested in our environment

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/426761/site-to-site-vpn-with-overlapping-subnets

rezafathiAuthor

Explorer III

Thanks. In one of them uses nat for both directions but in another it only uses nat for outgoing direction. I am confused

kmohan

Staff

Hi Rezafathi

Follow the kb articles:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-IPsec-tunnel-with-Overlapping/ta-p/242267

Inbound traffic and outband traffic with VIP configuration they have enable NAT on the Kb articles:

In the Documentation there is not VIP mentioned on the Policy, so it's not added.

rezafathiAuthor

Explorer III

Why there is no ip pool configured in kb? Also vip is mentioned on other document.

Sign up

Login with SSO

Login to the community

Login with SSO