How to allow access between remote IPSec endpoints?

[generaltab]

Greetings,

I have a FortiGate at the main office, subnet 192.168.1.0

There are several hardware-based IPSec VPNs for remote locations:

Remote office 2, subnet 192.168.2.0

Remote office 3, subnet 192.168.3.0

Remote office 4, subnet 192.168.4.0

and so on.

The main office can reach each of the remote offices.

How can I allow each of the remote offices to reach each other?

Thank you,

Steve

[rgesche]

two options:

option one: you configure in any office ipsec connections to any office

option two: add all subnets in  ipsec phase 2 options of ipsec configuration for any tunnel, create routing entries in remote offices for destionation subnets (other rekote offices) over ipsec inteface and corresponding firewall rules on all fortigates.

[generaltab]

Thanks. Does anyone know of a guide for accomplishing this?

[rgesche]

https://cookbook.fortinet...e-selectors/index.html

[ede_pfau]

The hub-and-spokes model is way less effort, in comparison to fully meshed (any to any). The hub would be the company FGT, the spokes the remote offices.

Some tips:

- use wildcard selectors in phase2, that is, '0.0.0.0/0' for local and remote subnet. You can thus route several different subnets over the tunnel without touching the VPN config

- on the hub FGT, put all tunnel interfaces of the spokes into a zone. If you like, allow intra-zone traffic. For more control, define policies from zone to zone (same to same interface), and differentiate the remote sites by address.

- if one plans ahead one would use one supernet for all remote offices (like 10.38.0.0/16) so that only one route would need to be pointed at the VPN zone. Much the same effect can be obtained by using named objects in static routes, especially address groups.

Just remember:

- no traffic without explicit policy

- no traffic without valid routes on both sides