Multiple IPSec VPNs with overlapping Subnets

[cronus]

Hello @ll,

I have the following situation:

At the HQ side I have a FortiGate 60E with v5.4.8, an internal LAN 10.100.0.0/24 and a static public ip address.

I have configured multiple IPSec VPNs and they have overlapping subnets at the remote side (all: 192.168.1.0/24).

Is there any possibility, e.g. IP Pools or VIPs, to get working VPN connections. And how can I do that?

Many thanks,

cronus

[Toshi_Esumi]

Are those vpns used only from remote->HQ direction? Then I would set 0/0<->0/0 vpns and set SNAT on remote sides on the outbound policy picking any NAT outside IP that doesn't conflict.  You can control routing by static routes.

But if HQ needs to access remote sides, how each devices at HQ specify each remote's device separately without different subnets?

[ericli_FTNT]

Hi there, you can define more specific subnet even host address for the VPN selector.