Permit traffic from vpn ( ipsec client to site ) to ( ipsec site to site ) over specific ip

[walvarezb]

Hello guys,  I have  two fortigates whit a vpn site to site stablished ( 192.168.88.0/24 local address in site 1  and 192.168.115.0/24 in site 2 ) this is up.  Ok, now in site 2 I have permited only specific ips  192.168.88.13-14-15 to connect to 192.168.115.0,  no more. This is ok, ping and other services, for example  192.168.88.13 ----->  192.168.115.163  ping up in site to site. 

Also I have a vpn client to site  IPSEC whit forticlient to some  remote users in the ip range ( dhcp vpn ) 192.168.88.201-250  over site 1.

I wish that a remote user for example  whit ip 192.168.88.210 to reach the ip 192.168.115.163 in the site 2 but only with the ips mentioned above 192.168.88.13-14-15

SQUEMATIC

Remote user ( 192.168.88.210 client to site)------>FG1----------Mapped(192.168.88.13)>(site to site IPSEC) -------> FG2 ------ >Server (192.168.115.163)

What is the step by step?    Thanks  for your reply.

[npariyar · Accepted solution]

In this case, create an IP pool for the IP range 192.168.88.13-192.168.88.15

config firewall ippool
edit "Test"
set startip 192.168.88.13
set endip 192.168.88.15
next
end

Then enable nat on the firewall policy (SSL to IPSec VPN ) and choose an ip pool (Here Test)

Eg:

config firewall policy
edit 9
set uuid a7ba2344-424f-51ee-83df-e5e2b419acc3
set srcintf "ssl.root"
set dstintf "overlay-br-port1"
set action accept
set srcaddr "all"
set dstaddr "192.168.115.0"
set schedule "always"
set service "ALL"
set nat enable
set ippool enable
set poolname "192.168.0.0/24"
set users "fortinet"
next
end

[sbabu]

HI, 

Please let me know if my understanding of your query is correct. 

the remote user from IP 192.168.88.210 should be mapped to 192.168.88.13 in site1 first and then that traffic should reach to site2 and then forwards to 192.168.115.163 

If my above understanding is correct then try to follow the below process. 
create a VIP on FG1 when  traffic with destination to 192.168.88.13 (port no) then it should forward to 192.168.115.163 (port no) 

If proxy-id is used in FG2 VPN setup, then please add 192.168.88.0 subnet. 

refer the below article for VIP config. 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...