Fixing IP overlap using virtual IPs

[4wheels]

Hi everyone. I'm new to the community and Fortinet in general. And it's exciting learning about all of the features of the fortigate.

This is likely a very simple issue to many of you.

I'm facing an predicament where some users are trying to access internal office resources abroad using SSL VPN, but seem to be facing a conflict because their home networks fall into the same subnet (192.168). Rather than re-addressing their entire home, or the office network, I've been following this guide which suggests virtual IP mapping might be an elegant solution: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-with-overlapping-subnets/ta-...

However, when I test it myself, I can connect to the VPN tunnel, but none of the local IP addresses get mapped to the new address ranges that I specify.

Admittedly, I get a bit confused by the terminology used in the UI, (such as "External IP address range") I'm not exactly sure which IP range I should put there. Is it the VPN tunnel IP ranges, or the user's home network range, or something else?

Any help or advice would be greatly appreciated.

[4wheels]

 

[4wheels]

With the lack of an answer, I went ahead and put my land IP range into that field from the screenshot above. Apparently that was the wrong thing to do because I lost connection to my FortiGate and FortiAp immediately And haven’t been able to get it back since even after two factory resets

[4wheels]

So I finally got everything back, and this experience has left me dazed and even more confused.

Firstly, I'm confused as to why simply creating a new IP pool (without assigning it to any interface, user, or group) was so destructive.

Secondly, anyone new enough to NEED to follow the guide that I'm trying to follow, should not be left to guess by trial and error on any steps, let alone something so damaging.

Thankfully this was just my home lab environment, but it could've been much worse. I'll eagerly await someone to guide me on what to do here so I can finish setting up the fix for IP overlapping, since I definitely don't want to reset everything again.