IPsec reach filias via central network

[gedO]

Hello,

Now I have this connection (shown in picture). All arrows means IPSec tunnels.

What I'm trying to do is to connect 172.17.0.0/22 network to 172.17.22.32/27 and 172.17.22.160/27 via 192.168.0.0/24. I want that all traffic from 172.17.2.0/22 to 172.17.22.0 networks go throw 192.168.0.0/24 network. How to achieve this?

[Christopher_McMullan]

You can likely accomplish your configuration through a static route, in the case of an interface-based VPN. Assuming a tunnel name of 'tunnel', on the FortiGate local to the 172.17.0.0/22 network, you'd want something like this:

config router static

edit 0

set dev tunnel

set dst 172.17.0.0/19

The subnetting isn't exact for the range you specified, so you'd probably want to add more specific masks comprising the destination subnets.

Then, on the 192.168.0.0/24 FortiGate, you'd define routes via the tunnels to the two other sites.