Greetings,
I have a FortiGate at the main office, subnet 192.168.1.0
There are several hardware-based IPSec VPNs for remote locations:
Remote office 2, subnet 192.168.2.0
Remote office 3, subnet 192.168.3.0
Remote office 4, subnet 192.168.4.0
and so on.
The main office can reach each of the remote offices.
How can I allow each of the remote offices to reach each other?
Thank you,
Steve
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
two options:
option one: you configure in any office ipsec connections to any office
option two: add all subnets in ipsec phase 2 options of ipsec configuration for any tunnel, create routing entries in remote offices for destionation subnets (other rekote offices) over ipsec inteface and corresponding firewall rules on all fortigates.
Thanks. Does anyone know of a guide for accomplishing this?
The hub-and-spokes model is way less effort, in comparison to fully meshed (any to any). The hub would be the company FGT, the spokes the remote offices.
Some tips:
- use wildcard selectors in phase2, that is, '0.0.0.0/0' for local and remote subnet. You can thus route several different subnets over the tunnel without touching the VPN config
- on the hub FGT, put all tunnel interfaces of the spokes into a zone. If you like, allow intra-zone traffic. For more control, define policies from zone to zone (same to same interface), and differentiate the remote sites by address.
- if one plans ahead one would use one supernet for all remote offices (like 10.38.0.0/16) so that only one route would need to be pointed at the VPN zone. Much the same effect can be obtained by using named objects in static routes, especially address groups.
Just remember:
- no traffic without explicit policy
- no traffic without valid routes on both sides
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1011 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.