Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
g3rman
New Contributor

Many-to-many NAT with overlapping subnet

We have the following setup:

 

Internal Interface: 172.16.1.1/24

DMZ interface: 192.168.0.0/24

DMZ 2 interface: 192.168.2.0/24

 

Remote office via site-to-site VPN: 192.168.0.0/16

 

We have to NAT the entire 192.168.0.0/16 network outbound using 172.18.0.0/16 to avoid overlap.

I.e. instead of me connecting to 192.168.x.x I connect to 172.18.x.x which gets translated as it leaves the IPSEC interface.

 

I setup a Virtual IP as follows:

Interface: IPSEC-interface

External IP Address/Range: 192.168.0.0 - 192.168.255.255

Mapped IP Address/Range: 172.18.0.0 - 172.18.255.255

 

This causes problems with our connected networks however, 192.168.0.0/24 and 192.168.2.0/24.

When the NAT is activated we lose connectivity to the directly connected 192.168 networks.

 

Would appreciate any insight on if/how we can translate the traffic ONLY if it's going out the VPN interface.

 

A Real World Fortinet Guide Configuration Examples & Frequently Asked Questions http://firewallguru.blogspot.com
A Real World Fortinet Guide Configuration Examples & Frequently Asked Questions http://firewallguru.blogspot.com
0 REPLIES 0
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors