Address translation to IPsec VPN

[stenull]

Hi all. New member here and fairly new to the forti world so please bare with me if im missing something obvious :) I have a fortigate 60C in my office and one offsite for remote access. I have IPsec VPN set up between them and working splendid. Now to my trouble, we had to add a bunch of machines on my office that is on the same subnet as the offsite network... My idea was to get a " new sub net" internally and have that translated the offsite sub net just before entering the tunnel. So what i did was to add a new Virtual IP with the settings: External Interface: internal External IP Address/Range: my " new sub net" Mapped IP Address/Range: Offsite sub net I then went to the policy that before allowed connection from my internal net to offsite VPN and changed Destination Address to my new Virtual IP.. The effects, i can now connect to my offsite machines with both sub net addresses... What am i missing out here. i obviously want the " old sub net" to stay at my office and i can' t find anywhere any allowance for the " old sub net" to my tunnel... Im continuing to study the manual and if any of you have a nice pointer or advice it is highly appreciated.

[ede_pfau]

BTW, the whole setup is similar (if not identical) to the " remote subnet behind tunnel has same address range as main subnet" scenario which is treated in the FortiOS Handbook and several KB articles. The VIP will translate a .48 address (not otherwise used on main subnet) to real .4 addresses for traffic traversing the tunnel. And will re-translate the reply traffic coming from the tunnel.

[ede_pfau]

IMHO translating an address at the entry to the tunnel or on the other end doesn' t really make any difference (as there' s no action IN the tunnel).

[stenull]

BTW, the whole setup is similar (if not identical) to the " remote subnet behind tunnel has same address range as main subnet" scenario which is treated in the FortiOS Handbook and several KB articles.

Thanks for the tip, il check it out and come back in a day or two. Thanks so far for the support! Now i' m going home for the day :)

[stenull]

ede_pfau, i don' t think that will do, the two networks have similar architectures. There are machines on same addresses in both environments... thats my big headache. Would it be easier to make the translation on the offsite FTG?

[rwpatterson]

ORIGINAL: stenull ede_pfau, i don' t think that will do, the two networks have similar architectures. There are machines on same addresses in both environments... thats my big headache. Would it be easier to make the translation on the offsite FTG?

Definitely! Doing that, you won' t have the same addresses to contend with any longer!

[ede_pfau]

But that' s why you started the whole thread for, right? Having remote and local hosts within the same subnet. To address the remote hosts, you use the .48 fake subnet which translates to the remote hosts' subnet behind the tunnel. To have the .48 traffic reach the tunnel you need a static route. And to have the .4 traffic reach wan1 you need a second route. There should not be any .4 traffic going to or coming from the tunnel! Otherwise, the NAT isn' t working properly.