Ipsec vpn tunnel for multiple networks

[comas17]

Hi all in our offices (headquarter and branch office) we are using 2 FGT (60C e 60D, firmware 5.2.1) I have configured a ipsec vpn tunnel connecting our internal lans and everything is working correctly Our internal lans are 192.168.20.x (headquarter) and 192.168.120.x (branch office) Now I need to connect also our telephones (voip). Headquarter telephones are using 192.168.1.x network so I configured a VLAN (network - interfaces - internal) with a speficic IP (192.168.1.252) I did the same also in remote office, using network 192.168.101.x (VLAN interface IP 192.168.1.1.252) I do not understand if I need to create another ipsec tunnel; i tried to create a new one, using the "site to site fortigate" template but I cannot complete as it says "Unable to setup VPN: duplicate remote gateway" (during the wizard I obvously insert the public IP address, and it's the same I have alerady used for my first ipsec tunnel) Do I need to create another tunnel ? how can I do ?

Thank you

Corrado

[emnoc]

You have 2 means

1: change the  vpn to a route-based if not already and use the default 0.0.0.0/0:0 and just point destination routes for the networks to be reached over the vpn ( hQ to remote )  ( remote to HQ ) for the respective site

2: just create a 2nd phase2-interface and specifiy the 2nd set of networks using the same phase1-interface

config vpn ipsec phase2-interface

 edit "esa-p2-1"         set phase1name "sesa-main"         set src-subnet 10.10.80.0 255.255.255.0         set dst-subnet 192.168.25.0 255.255.255.0     next

 edit "esa-p2-2"         set phase1name "sesa-main"         set src-subnet 10.10.80.0 255.255.255.0         set dst-subnet 192.168.26.0 255.255.255.0     next

end

I like the later since you now have diagnostics for each set of proxy-ids with the diag vpn tunnel list command, so it helps to determine tx/rx-bytes sent per networks.

As usual and stated earlier, route-based vpns needs a "route" so in the 2 above I have a route to {192.168.25.0, 192.168.26.0 } networks

config router static

  edit 88

     set dst 192.168.25.0/24

      set device "sesa-main"

   next

  edit 89

     set dst 192.168.26.0/24

      set device "sesa-main"

   next

 end

Check out the fortinet cookbook for more tips , examples, or search in this support forum.

[comas17]

Hi emnoc thank you I've seen that the wizard I used to create the IPSec tunnel added 2 subnet addresses (local lan and remote lan) in each FGT and created also 2 new policies using these addresses and the tunnel name as interface Do I need to create 2 more subnet addresses in each FGT (my voip networks) and create 2 more policies using the same tunnel name ? Thank you