Fixing IP overlap using virtual IPs

[4wheels]

Hi everyone. I'm new to the community and Fortinet in general. And it's exciting learning about all of the features of the fortigate.

This is likely a very simple issue to many of you.

I'm facing an predicament where some users are trying to access internal office resources abroad using SSL VPN, but seem to be facing a conflict because their home networks fall into the same subnet (192.168). Rather than re-addressing their entire home, or the office network, I've been following this guide which suggests virtual IP mapping might be an elegant solution: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-with-overlapping-subnets/ta-...

However, when I test it myself, I can connect to the VPN tunnel, but none of the local IP addresses get mapped to the new address ranges that I specify.

Admittedly, I get a bit confused by the terminology used in the UI, (such as "External IP address range") I'm not exactly sure which IP range I should put there. Is it the VPN tunnel IP ranges, or the user's home network range, or something else?

Any help or advice would be greatly appreciated.

[amrit]

Example:

SSLVPN remote user's local wifi subnet is 192.168.0.1/24 and the internal office lan is also 192.168.0.1/24

In this case, the internal IP range should be 192.168.0.1-192.168.0.254 the external IP address is the address you will map with your internal range. That means this address(external) will be installed on the user's PC and can be verified with the "route print" command on Windows. The purpose of the external address is to provide a unique address to the user that should not conflict with the local ip address space of the user. When user ping the address 172.16.0.1 , the fortigate will translate this address to 192.168.0.1 and will send the request to your internal network via the policy and VIP.