IPsec VPN

[CHAMPE]

Hello all
I'd like some insight on this
Currently we have an IPsec tunnel between two sites, site A is the client and site B is the service provider, there is an application server and web server on site B. On site B, the tunnel has the local address to be the ip of the web server and the ip of the application server and the remote address is a /32 host on site A and the firewall's LAN ip. On site A, the remote address is that of the web server and that of the application server, while the local is that of the /32 host and the firewall's LAN ip

all phase 2 selectors are up. the service provider mentioned for other users, that are currently on a different VLAN, to access the service on site B, a NAT should be created such that the user vlan source address will be translated to the firewall's IP address.

Is it possible to achieve this? I created a dynamic ip pool and entered the firewall's IP address as the NAT ip, but I'm still not lucky ?

[kgeorge]

Hello @CHAMPE 

You would need to first add the Phase2 selectors with VLAN subnet as Local and the Remote Subnet with same details as the first one.

Once done, you can use this VLAN Subnet in the respective IPSec VPN policy and NAT enabled with IP Pool address of that FortiGate LAN IP.

This should help I suppose.

Kindly try and let us know.

[CHAMPE]

---

@kgeorge wrote:

Hello @CHAMPE 

You would need to first add the Phase2 selectors with VLAN subnet as Local and the Remote Subnet with same details as the first one.

Once done, you can use this VLAN Subnet in the respective IPSec VPN policy and NAT enabled with IP Pool address of that FortiGate LAN IP.

This should help I suppose.

Kindly try and let us know.

---

Hi kgeorge.

According to Site B's security policy,only one host should be allowed to access the site, then others can access the service from that particular host. I'm not sure how I can do this

[vsahu]

Hello CHAMPE,

If I'm correct your setup is, If this is not correct please share a network diagram to understand it better.
Vlan------SITEA======VPN=====SITEB----Server

The traffic selector, you're having is on site A, Lan interface IP toward the Server all /32 subnet, and on-site B vice-versa,

If this is the setup and traffic is initiated from the VLAN side you cannot NAT it to LAN interface IP because the NAT function works either with outgoing interface IP or an IP pool, and if you're using an IP pool that IP can only be the outgoing interface IP/subnet or some random IP/ subnet which you've not configured on Firewall as an Interface IP, because firewall treat all interface IP as local IP and kernel route points towards the root, and kernel route take preference and packet will be dropped at the firewall.

You can follow the below guide for your scenario it might help.
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/426761/site-to-site-vpn-with...

[CHAMPE]

Hi 

USERVLAN...>BRIDGE SVR....SITE A:::::VPN::::SITE B....>SERVICE

I believe the random ip idea would work. That means I'll have to change the remote address on site B to the random IP that I'll use for NATing. Right? 

[vsahu]

Hello,

yes that is correct, at your side traffic sector would be 
Random IP --- Remote IP
And at the remote side, the traffic sector would be 
Remote IP ---- Random IP

Now on your side, You'll have to create a policy with NAT enabled and configure the random IP pool and add it as NAT IP (basically PAT), then the traffic will work from VLAN to the remote side, but if traffic is initiated from Remote side will not work as at your firewall side we're doing PAT.