HELP! IPSEC Site-to-Site with overlapping subnet

[daveteoh]

Hi All Gurus,

I urgently need help on the following-

I need to create a site-site VPN between two site which is using the same subnet.

eg.

|Site A,192.168.1.0/24|---- |Fortigate 90D|---- |Tunnel| -----|Fortigate 90D| ----|Site B, 192.168.1.0/24|

User in site A should be able to access Servers in Site B just like a local area network (join server domain, print server, DHCP etc)

I tried to follow the guideline from the official handbook but it doesnt work. I could have missing some steps.

I also followed the guideline here..

http://docs.fortinet.com/...verlapping-subnets.pdf

http://www.fortinetguru.com/2016/10/gateway-to-gateway-configurations/5/

Appreciate any of your kind advise.

[Toshi_Esumi]

I luckily didn't have to deal with this personally I don't have any first-hand experience. But I found an article discussing about Windows Domain behind NAT. It has a link to Microsoft's official answer to this situation at the end.

http://serverfault.com/questions/106776/windows-computers-joined-to-a-domain-behind-nat

But first thing you need to verify is the clients on one side can ping the servers on the other side.

[SCSIraidGURU]

VPN users should have a unique subnet.  You enable split tunneling and give access to the VLAN/interfaces they need access to.