Create branch office VPN so that a port on the firewall is the main office network.

[irisit]

I would like to create a link between a warehouse and the main office. The main office has a Fortigate 61E and the warehouse a Fortigate 40F. Essentially, I would like to bridge the warehouse and main office in a way such that one port on the 40F is the main office network. They are installing a security system in the warehouse and would like to use the controller in the main office rather than installing a separate controller in the warehouse. The requirement is that the controller and all security devices are the same subnet. There are no servers etc. in the warehouse, only two workstations which would also need to authenticate against an AD server in the main office.

I have tried various combinations of site-to-site VPNS without success. Is this at all possible?

Thanks for any help.

Kind Regards

Robert Andrews

[msolanki]

Hi Rebort,

You can achieve it by Site - to site IPSEC VPN and on main office you can integrate the AD via LDAP etc - Regarding subnet so you can you even multiple subnet by controlling in ipsec firewall policy .

Thanks 
madhav

[pminarik · Accepted solution]

Same subnet, as in the same broadcast domain, for different locations? VXLAN is the answer.
Either plain VXLAN, or VXLAN over IPsec if there's a tunnel between them.

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/38079/vxlan

[0xNat]

Sorry. Didn't read thourough about both devices sharing a subnet :)

[irisit]

Thanks for your help.

Working as expected.

Cheers Robert