Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
forti_tude
New Contributor

Overlapping ip addresses over IPSec VPN

Hello team,

 

We have the following IP overlap between host_a and host_b:

 

[(host_a 10.10.10.10/24) site_X] <---- IPSec ----> [site_Y] <---- IPSec ----> [site_Z (host_b 10.10.10.10/24)]

 

Traffic will be initiated from host_a  --- > host_b direction only.

 

Any recommendations for overcoming this overlap? -

 

We have no control over [(host_a 10.10.10.10/24) site_X] and would therefore prefer to do any configuration on [site_Y] 

 

Thank you and regards,

 

fort_tude

4 REPLIES 4
ozkanaltas
Contributor III

Hello Forti_tude,

 

You can use VIP (DNAT) object on site Z. For example; 

 

Site Z Conf: 

VIP Object(DNAT): 10.10.20.10 -> 10.10.10.10

S2S Phase 2 Conf: 

remote subnet: 10.10.10.10

local subnet: 10.10.20.10

 

Site X Conf: 

S2S Phase 2 Conf : 

Local Subnet: 10.10.10.10

Remote Subnet: 10.10.20.10 

 

After this configuration. Site Z should access to the application with a new nat IP.

 

Btw if traffic also initiates from site Z. You should also do nat configuration on site X.  If they not, this configuration should be enough. Because Fortigate will not control routing information for return traffic.

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE4-5-6-7 OT Sec - ENT FW
srajeswaran
Staff
Staff

Below URL explains this scenario.

 

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/426761/site-to-site-vpn-with...

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

forti_tude
New Contributor

Thanks ozkanaltas and srajeswaran.

 

Please note that there is no direct IPSec S2S vpn between site_X and site_Z.

 

They just happen to both have an IPSec S2S VPN each to site_Y.

 

Do your suggestions still apply?

 

Thank you and regards,

 

fort_tude

ozkanaltas
Contributor III

Hello forti_tude,

 

You can still apply this solution. But be careful at determining new nat IP address. This IP address should not used on sites X,Y and Z. 

 

Site Z Conf: 

VIP Object(DNAT): 10.10.20.10 -> 10.10.10.10

S2S Phase 2 Conf: 

remote subnet: 10.10.10.10

local subnet: 10.10.20.10

 

Site Y Conf: 

Static route or policy route: 

DST: 10.10.10.10

Interface: Tunnel X

---------

DST: 10.10.20.10

Interface: Tunnel Z

 

S2S Phase 2 Conf on between X and Y tunnel: 

remote subnet: 10.10.10.10

local subnet: 10.10.20.10

S2S Phase 2 Conf on between Y and Z tunnel: 

remote subnet: 10.10.20.10

local subnet:10.10.10.10

 

 

 

Site X Conf: 

S2S Phase 2 Conf : 

Local Subnet: 10.10.10.10

Remote Subnet: 10.10.20.10 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE4-5-6-7 OT Sec - ENT FW
Labels
Top Kudoed Authors