Description
This article describes how to establish connectivity from Hosts of Site_A to Hosts of Site_C using IPsec Tunnel,
OR
Configuration steps required to reach Site C from Site A or vice versa when both sites terminate IPsec VPN at site B.
Site_A = 192.168.10.0/24
Site_B = 192.168.20.0/24
Site_C = 192.168.30.0/24
Scope
FortiGate.
Solution
Topology:
Prerequisites:
- Site A – Site B IPsec Tunnel should be established and working fine.
- Site B – Site C IPsec Tunnel should be established and working fine.
Solution.
Site A configuration: reach Site C.
Here, there is one IPsec tunnel configured for connectivity to Site B (A_to_B).
1) Add Phase 2 Selectors for Site C in that A_to_B tunnel. Local = Site A and Remote = Site C.
2) Create a Static Route for Site C destination to enter the A_to_B Tunnel Interface.
3) Create a Firewall Policies for Site A and Site C for Inbound and outbound traffic.
Site B configuration: connect Site A and Site C.
Here, there are two IPsec tunnels configured. One for connectivity to Site A (B_to_A) and other for Site C (B_to_C).
Note.
No need to configure new Static Routes as there are already present as a part of B_to_A and B_to_C IPsec tunnels.
1) Add Phase 2 Selectors for Site A and Site C in B_to_A IPsec tunnel. Local = Site C and Remote = Site A.
2) Add Phase 2 Selectors for Site A and Site C in B_to_C IPsec tunnel. Local = Site A and Remote = Site C.
3) Create a new Firewall Policy which allows traffic from Site A to Site C and reverse, using the Incoming and Outgoing port as Tunnel Interfaces of both IPsec tunnel configured on Site B as shown in the image below.
The multiple interfaces have been used in one policy.
Site C configuration: reach Site A.
Here, there is one IPsec tunnel configured for connectivity to Site B (C_to_B).
1) Add Phase 2 Selectors for Site A in that C_to_B tunnel. Local = Site C and Remote = Site A.
2) Create a static route for Site A destination to enter the C_to_B tunnel interface.
3) Create a firewall policies for Site C and Site A for Inbound and Outbound Traffic.
Result: Ping from 192.168.10.2 (Site_A) to 192.168.30.2 (Site_C) and it will work.
