How to WiFi at branch office route across tunnel to head office?

[Westcana]

I have a branch office that has a point to point vpn with the head office. This link has been operating flawlessly for months now. Clients on either end can communicate with clients on the other end. There is no nat between the sites. Each branch office has it's own subnet. The branch offices are using Fortigate 50E and the head office is using Fortigate 60E. The branch office Fortigates are the type that have build in WiFi, so the fortigate is aware of the subnet for the wifi and acts at the gateway/dhcp/dns for the wifi network. The branch offices have a private wifi that is on it's own unique subnet that is able to reach the wired subnet at it's own branch. However I am unable to have that private wifi reach the head office subnet. There is no nat between the private wifi and the wired network.

[brycemd]

There are 3 parts to getting this done:

1. Routing - Do the firewalls have a route to get to the wifi network via tunnel

2. ipv4 policy - Is the traffic allowed based on firewall rules interface/source/destination

3. Phase 2 selectors - Does the traffic match the VPN tunnels phase 2

[brycemd]

There are 3 parts to getting this done:

1. Routing - Do the firewalls have a route to get to the wifi network via tunnel

2. ipv4 policy - Is the traffic allowed based on firewall rules interface/source/destination

3. Phase 2 selectors - Does the traffic match the VPN tunnels phase 2

[brycemd]

There are 3 parts to getting this done:

1. Routing - Do the firewalls have a route to get to the wifi network via tunnel

2. ipv4 policy - Is the traffic allowed based on firewall rules interface/source/destination

3. Phase 2 selectors - Does the traffic match the VPN tunnels phase 2

[rwpatterson]

If the VPN on the remote firewall is set up in policy mode, you'll have to break it and recreate it in interface mode. When that is done, you can assign a route for that traffic to get it away from the default route out the door.

[Westcana]

1. I would have assumed that the tunnel (having been setup using the vpn wizard) would automaticly include the remote sites subnets. Certainly that worked for the wired networks. That being said, I did create static routes but didn't see any change. 2. Policies are in place allowing the traffic

So that would be to change the Phase 2 selectors local and remote address's to subnet instead of named address? Can I just add a subnet instead of changing the existing settings?

[rwpatterson]

You may be able to. I never messed with selectors once my tunnels came up. I HAVE added more phase two selectors but if I had a working phase two pair working, it was voluntarily locked out more or less.

[Westcana]

So making changes to a working vpn tunnel may not have any effect? I have been trying to add the selectors to both sides but still can't get traffic to pass.

[rwpatterson]

You will also need the corresponding policies present.

VPN tunnel + routes + policies = traffic

[Westcana]

Is there a way to test each step of this. There are the 3 parts that need to be correct. Actually 6 if I understand correctly because these settings need to be completed on both sides.

Although I think I have everything set, I just can't seem to get it to work.