Double VPN Communication

[joru]

Hello, We have been trying to communicate via IPSec VPN a branch office passing trough the main office to an external network each step has a different VPN, the setting is the following: -There is a FG80C in the branch office which have a working site-to-site VPN with a FG200B in the main office -There is a working site-to-site IPSec VPN between FG200B and an External Checkpoint Firewall. What we need is to be able to communicate from the FG80C passing through the VPN with FG200B and then passing trough the 2nd VPN from FG200B and the Checkpoint to the final destination. So far from the FG80C the packets that go to the final destination network go through the VPN with the FG200B, checking the logs in a FortiAnalyzer we found out that those packets arrive from the internet port and go to the internet port so there we put a firewall policy which encrypts with the FG200B-Checkpoint VPN but the log says it doesn´t use it and instead the packets go through the implicit policy. Does anyone know how can this be configured? or where is my mistake? Thanks

[joru]

In brief what I' m needing is somenone' s advice in how to get from one network to another passing through two different IPSec VPNs. src network--->FG80C--->vpn---->FG200B--->vpn--->Checkpoint--->dst network This is because in the final network only can provide us one tunnel (the FG200B to Checkpoint one) but there is an additional network in the branch office (the FG80C) that is needing this access as well.

[rwpatterson]

Create an IP pool on the 200B with a spare IP address from it' s LAN that is permitted across the WAN and apply it to the policy permitting the source network through. A simple NAT translation.

[joru]

Thanks for the answer haven' t thought of that. Well both VPNs are in policy mode so in the FG200B I have two policies from LAN->Internet, to perform the NAT in this case I can' t use the IP pool but instead I can use the natoutbound so right now this is how it is: VPN_FG200B_Checkpoint LAN--->NAToutbound--->Destination VPN_FG200B_FG80C LAN--->RemoteOffice With this configuration if I add other local networks on the source address of the VPN_FG200B_Checkpoint encryption policy they are able to reach the destination without problem. In this case what I should do then is to add RemoteOffice to the source addresses of the firewall policy of VPN_FG200B_Checkpoint right?: VPN_FG200B_Checkpoint LAN,RemoteOffice--->NAToutbound--->Destination VPN_FG200B_FG80C LAN--->RemoteOffice

[rwpatterson]

Not sure if the will work using IPSec policy mode on the 200B. You may need to switch to interface mode. You will be happier in the end.

[joru]

Well it didn' t worked so I' ll take your advice and embrace the change, next week I' ll be configuring the VPNs in interface mode and let you know how it goes.

[joru]

Thank you very much rwpatterson, changed both VPNs to interface mode, then applied the IP pool as suggested and this time it worked!