Managing the FortiSwitch and Fortiap in the HQ

[Tannu1986]

fortigate in headquarter and switch and fortiap in the branch office connected in VPN is it possible to connect them to the fortigate? Are they managed by the fortigate? can I address them at the IP level? how do I do it? keep in mind that the VPN based (91fgt) while in the shops there are mikrotik all connected in IPSEC.

I attached the PHOTO

[saleha]

Hi,

Thank you for your inquiry. Yes you can manage FortiSwitch and FortiAP remotely through ipsec tunnel were the controller/HQ fortigate have to receive these packets through IPSEC tunnel. This will required that the branch router where the FSWs and FAPs are directly connected is allowing this traffic through the tunnel with the required rules and routes as well as the ipsec phase2 selector on the ipsec tunnel have to include the ip addresses for the subnet that connects these devices. ON the HQ fortigate similar config is required:
1- firewall policy where the source interface is the ipsec tunnel and destination is the fortilink interface with matching ip addresses for source and destination

2- routes allowing the HQ fortigate to learn about the remote subnets belonging to the FAPs and FSWs.

3- phase2 selector must be configured on the fortigate where the remote address is that of the fortiswitches and the fortiaps.

Note: I assumed site-to-site ipsec tunnel connecting HQ fortigate to the remote/branch router. If fortigate configuration is "Dialup server" vpn then phase2 selectors will not have any addresses as the dialup server learn those from the connecting dialup clients.

Thank you,

saleha