Skip to main content
Pillar
Pillar
Explorer
October 14, 2024
Solved

VPN Tunnel - Overlapping Subnets

  • October 14, 2024
  • 2 replies
  • 2635 views

My company is trying to set up a site-to-site IPsec VPN tunnel with another companies' network. When configuring the VPN tunnel, we ran into an issue where both networks on either end of the tunnel have the same ip range/subnet 10.1.10.0/24. It is the primary and only private Ip/subnet for our company and the other company utilizes the IP range and subnet along with a few others. 

Rather than changing our private Ip range/subnet I was looking to utilize NAT to translate our private Ip to another range/subnet when accessing the other company via the VPN tunnel. But have been having a difficult time finding information on exactly what steps to take to complete this within the FortiGate GUI. We have a FortiGate 40F any help or even recommendations would be appreciated.

2 replies

johnathan
Staff
johnathan
Staff
October 14, 2024

Let's say you wanted to access a server at 10.1.10.22 over the VPN.

You can use a subnet that does not already exist in your network to map this to.

I will use 100.64.0.22 as this is probably not used in your network.

You can make a VIP with 100.64.0.22 as the external IP, and 10.1.10.22 as the internal IP.
You would then make a policy with the source interface being where the users are at and the destination interface will be the tunnel. Source IP can be 'all' (or whatever you want) and the destination will be the VIP.

At this point, if you were to ping 100.64.0.22, you would see the traffic go across the tunnel and hit 10.1.10.22. 
You can make it the whole subnet if you like, this is seen here: https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/426761/site-to-site-vpn-with-overlapping-subnets

Never trust a computer you can't throw out a window.
    Terms & ConditionsAccessibility statement