Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
wenwei81
New Contributor

Multi SItes

Hi I have 4 sites details as follow

 

HQ Site 

192.168.1.0/24

Site 1 

192.168.0.0/24

Site 2 

10.0.0.0/24

Site 3

172.31.0.0/24

 

All the sites have a site to site vpn connected to HQ. How can i configured for the differenet sites to communicate among themselves? Example

 

Site 3 needs to access site 1 Data and Site 2 Needs to access Site 3 data.

 

Besides creating the sites to have site to site vpn with each other , can the different sites connect through HQ to access the required sites? 

 

Deeply Appreciate for any advice.

 

 

5 REPLIES 5
Julien87
Contributor II

Hi,

if I understood your infrastructure correctly.

 

If you use vpn site at site and no advpn, you must configure the policies on the HQ site to allow flows on the VPN interfaces And then check the routing tables on each site to indicate the addresses of the remote sites.

 

Best regards,

 

Julien

Julien
Julien
rwpatterson
Valued Contributor III

There are two ways to do this:

 

1) Put all the sites into a zone and allow intra-zone traffic

 

2) Make policies from site 1-2, site 2-3, site 1-3, etc.

 

The method you choose depends on how granular you wish to be. If you need filtering between different devices, then the second would be your option. If you trust everything and just want then to work, then the first option.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
wenwei81

hi i have tried. but sites still did not able to ping each other. Any other things i must take note?

Julien87
Contributor II

Hi, 

 

have you launched diagnose sniffer command or diagnose debug flow ? to check where the traffic is blocked?

 

Best regards,

 

Julien

Julien
Julien
Julien87

Hi, 

Other question, the phase2 contains all remote network ?

 

Best Regards,

 

julien

 

Julien
Julien
Labels
Top Kudoed Authors