Hub and spoke configuration problem

[#1]

I tried a hub and spoke configuration with 3 fortigate equipments. So the configuration is the following: HUB: internal network 192.168.222.0/24 external static ip SPOKE1: internal network 192.168.105.0/24 external dialup-user SPOKE2: internal network 192.168.98.0/24 external dialup-user what works: SPOKE1 ---VPN --- HUB SPOKE2 ---VPN --- HUB I' m using policy based VPN. what not: SPOKE1---HUB---SPOKE2 from the network 192.168.105.0/24 to 192.168.98.0/24 Error: No matching IPsec selector, drop on the spoke which tries to transmit. i understand the error it comes from the fact that i put quick mode selector on the spoke source : 192.168.105.0/24 and destination 192.168.222.0/24. It is obvious that it will not work but how it works? If I put quick mode selector 192.168.0.0/16 source and destination the hub will drop the VPN connections because it has two VPN connections with same selector. I used the documentation FortiGateâ„¢ IPSec VPN Version 3.0 MR5 with hub-and-spoke configuration on policy based VPN. I even set up the concentrator but anyway the problem is at the spoke not the hub. I' m open to any ideas. Or any documentation which tackles this problem in detail. Thank you for any input. Please ask if you need any details.

[jlingle]

what do ur routes look like?

[rwpatterson]

With policy based, you will not see any routes. I would highly recommend interface mode tunnels.

[jlingle]

whoops missed that...yeah i use interface mode/route based and it works great.

[#5]

Thanks for all your input. As I was saying I' m not proficient in interface mode VPN but I tried it. And it doesn' t work. What I did was the following: -At hub: VPN interface mode policy for in and out and I build a zone to ease my configuration At Spoke VPN interface mode policy for in and out route for the aggregate network All well for the first spoke (and that is working) but when I tried to build the second I realized that in configuring the VPN the configuration was the same. This is a big problem how does the hub differentiate between the two connections???? Thanks again for your responses. Again if you need any more data I am more than happy to provide.

[rwpatterson]

Under ' Network > Interface' , you will see the new interfaces. (You may need to click the blue arrow next to the major interface first) You will need to give both sides IP addresses on the same network. Once that is done, you can now add static routes between the sites. This will prevent the FGT routing the remote traffic out of the default gateway. Hope that helps.

[#7]

Thanks for help. I am amazed but it works. So on the HUB i put ONE interface mode VPN and all the spokes connect to that and everything works. Thanks one more question what if i want one or more different domains meaning: SPOKE1_D1-------| | SPOKE2_D1-------|HUB | SPOKE1_D2-------| | SPOKE2_D2-------| | And the spokes from the same domain see each other but not from different domains how it can be done? I am interested if you can use two or more interface based VPN on the hub and to choose from the spoke to what VPN interface to connect. (If yes how? if no why?). Thanks again for all your help.

[rwpatterson]

If all the VPNs into the hub are interface based, then you create policies deciding who talks to whom. No policy, no communication. For example, even if two domains are coming in through one tunnel, you will need a policy from and to the same interface with the source being one IP range, and the destination being the other.