Skip to main content
Tanguy
Tanguy
New Member
March 25, 2019
Question

traffic from a VPN to anaother

  • March 25, 2019
  • 1 reply
  • 2996 views

Hi I have a fortigate 200D on which too others VPN arrives. And the two remote VPN to communicate.  On each Phase 2 I declared the adresses from remote sites. And I made a policy rule to authorize VPN1 to VPN2 (and reverse) on the Fortigate 200D... 

I tried to debug but I can't find any solution...

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    March 25, 2019

    For spoke-to-spoke, you need to take care of 1) phase2 selectors, 2) routing, and 3) policies at all three parties: HUB, spoke1, and spoke2. Perhaps, the spokes don't have a route into the tunnel to get to the other spoke.

    To debug at the hub (200D), you need to disable asic offloading on the policies in CLI (set auto-asic-offload disable).  Then you can run sniffer and/or flow debugging.

    hawada
    hawada
    New Member
    March 25, 2019

    Hello,

     

    As I have understood you have two sites which are connected via ipsec tunnels to your 200D FGT, and you want site A to communicate with site B via 200D FGT right?

    If so it is very simple you can create an ip-pool on 200D by using a free available IP on your LAN as External IP with type overload. Then create an IPv4 policy for remote LAN A to remote LAN B and under NAT option select the ip-pool you have just created, then clone reverse the policy. Traffic can then propagate between both sites.

    Terms & ConditionsAccessibility statement