This forum has been exceptionally helpful in the past, and I' m hoping it can help me out again.
Our client has two offices, Office A and Office B.
Here is what we have in Office A:
A FortiGate (90D) with a VPN to office B FortiGate (140D)
A phone system with an on premise phone server running off RH Linux
An Active Directory subnet for Office A <---> Office B through the VPN
There are three VLANs. One is default, one is voice, and one is for routing Adtran traffic stuff (phones are not my area of expertise -so " stuff" is as technical as it gets)
Due to limitation in cabling, the data cable goes to the phone, then the PC cable goes from the phone to the PC.
Switch is configured for LLDP-MED, with CoS for VLAN 2
Everything works fine for Office A. Yay phones.
Here is what we have in Office B
A FortiGate with a VPN to office A FortiGate
An Active Directory subnet for Office B <---> Office A through the VPN
Like Office A, there are three VLANs. One is default, one is voice, and one is for routing Adtran traffic stuff
Switch is configured for LLDP-MED, with CoS for VLAN 2
WAN is your basic business-class cable WAN, with lots of bandwidth and a few static IPs on each end.
Here' s the VLAN info:
Office A default VLAN 1: 192.168.100.0/24 (DHCP is local to the A-DC1 AD server)
Office B default VLAN 1: 192.168.101.0/24 (DHCP is local to the B-DC1 AD server)
Both Office A & B, VLAN 2 (voice): 10.10.10.0/24 (DHCP is local to the phone server
Both Office A & B, VLAN 10 (Adtran public): 192.168.200.0/24
How do I ensure that VLAN2 is homogeneous on both sides of the VPN fence so that phones get DHCP addresses from the phone server located in Office A and Office B phones pass traffic to and from the Office A phone server?
Don' t laugh. Thanks.
Why would you want to do that is my 1st question?
Want I would do instead ;
1: is to create a voice-subnet that' s unique at office B
e.g
10.10.20.x/24
2: Create a phase2-interface for this traffic
3: Apply firewallpolicies for voice-phones to reach softPBX at site " A" to allow traffic from voice A to voiceB and phones to softPBX
4: Install a route for this network
the above assume your using a route-based vpn
5th: Use the DHCP relay to relay-dhcp requests from site " B" to site " A" dhcp server.
note: would create a dhcp relay-server for voice vlan#2 and point it to dhcp-server-voice at site A and set the mode to be " relay"
btw, nice diagram. This helped with providing a clear picture of your dilemma 
So I haven’t been able to work on this much, but now that I have, I’ve run into some problems. It doesn’t help I have a deadline that was yesterday. As always, I can use any guidance available. I' ve included a new image that hopefully clarifies some of the more detailed setup assumptions.
First, VLAN10 is no longer necessary, since that was for external management of the PBX. I found a better way.
So I followed your setup as much as possible, but I’m not getting anywhere. I know there are multiple single-point-of-failure, but this is the best we can do. As a non-profit, we have a budget that simply does not allow for something better, at least not for the next while.
Anyway, can you let me know what I’m doing wrong here?
Here’s the interface setup for Office A:
WAN1 = External interface to the internet 65.65.0.100/48
A-to-B =Tunnel generated by VPN
INTERNAL1 = internal interface to L2 switch, 192.168.100.100/24
Voice = VLAN interface ID=2, 10.10.10.100/24
config system interface
edit " wan1"
set vdom " root"
set ip 65.65.0.100 255.255.255.248
set allowaccess ping https fgfm auto-ipsec
set type physical
set alias " A Internet"
next
edit " internal1"
set vdom " root"
set ip 192.168.100.100 255.255.255.0
set allowaccess ping https ssh http fgfm capwap
set type physical
next
edit " A_TO_B"
set vdom " root"
set type tunnel
set interface " wan1"
next
edit " Voice"
set vdom " root"
set ip 10.10.10.100 255.255.255.0
set allowaccess ping
set interface " internal1"
set vlanid 2
next
Here’s the interface setup for Office B:
WAN1 = External interface to the internet 66.66.0.100/48
B-to-A =Tunnel generated by VPN
INTERNAL1 = internal interface to L2 switch, 192.168.101.100/24
Voice = VLAN interface ID=2, 10.10.20.100/24, DHCP relay to 10.10.10.200
config system interface
edit " wan1"
set vdom " root"
set ip 66.66.0.100 255.255.255.248
set allowaccess ping https fgfm
set type physical
set alias " B Internet"
next
edit " mgmt"
set vdom " root"
set ip 192.168.11.99 255.255.255.0
set allowaccess ping https fgfm capwap
set type physical
next
edit " internal1"
set vdom " root"
set ip 192.168.101.100 255.255.255.0
set allowaccess ping https fgfm capwap
set type hard-switch
next
edit " B_TO_A"
set vdom " root"
set type tunnel
set interface " wan1"
next
edit " Voice"
set vdom " root"
set dhcp-relay-service enable
set ip 10.10.20.100 255.255.255.0
set allowaccess ping
set snmp-index 13
set dhcp-relay-ip " 10.10.10.200"
set interface " internal1"
set vlanid 2
next
As for routing:
Office A:
Destination IP: 192.168.101.0/24 | Device: A-to-B
Destination IP: 10.10.20.0/24 | Device: A-to-B
And the usual WAN1 Gateway to 65
config router static
edit 1
set device " wan1"
set gateway 65.65.0.96
next
edit 2
set device " A_TO_B"
set dst 192.168.101.0 255.255.255.0
next
edit 4
set device " A_TO_B"
set dst 10.10.20.0 255.255.255.0
next
end
Office B:
Destination IP: 192.168.100.0/24 | Device: B-to-A
Destination IP: 10.10.10.0/24 | Device: B-to-A
config router static
edit 1
set device " B_TO_A"
set dst 192.168.100.0 255.255.255.0
next
edit 3
set device " wan1"
set gateway 66.66.0.96
next
edit 4
set device " B_TO_A"
set dst 10.10.10.0 255.255.255.0
next
end
VPN setup:
Office A:
config vpn ipsec phase1-interface
edit " A_TO_B"
set interface " wan1"
set proposal 3des-sha1 aes128-sha1
set remote-gw 66.66.0.100
set psksecret <secret>
next
end
config vpn ipsec phase2-interface
edit " A_TO_B2"
set phase1name " A_TO_B"
set proposal 3des-sha1 aes128-sha1
next
Office B:
config vpn ipsec phase1-interface
edit " B_TO_A"
set interface " wan1"
set proposal 3des-sha1 aes128-sha1
set remote-gw 65.65.0.100
set psksecret <secret>
next
end
config vpn ipsec phase2-interface
edit " B_TO_A2"
set phase1name " B_TO_A"
set proposal 3des-sha1 aes128-sha1
next
Firewall Policies:
Office A:
edit 2
set srcintf " internal1"
set dstintf " A_TO_B"
set srcaddr " A VPN Group" [contains 192.168.100.0/24 and 10.10.10.0/24 addresses]
set dstaddr " B VPN Group" [contains 192.168.101.0/24 and 10.10.20.0/24 addresses]
set action accept
set schedule " always"
set service " ALL"
next
edit 3
set srcintf " A_TO_B"
set dstintf " internal1"
set srcaddr " B VPN Group"
set dstaddr " A VPN Group"
set action accept
set schedule " always"
set service " ALL"
next
edit 13
set srcintf " Voice"
set dstintf " internal1"
set srcaddr " A_VLAN2" " B_VLAN2"
set dstaddr " A LAN" " B LAN"
set action accept
set schedule " always"
set service " ALL"
next
edit 14
set srcintf " internal1"
set dstintf " Voice"
set srcaddr " A LAN" " B LAN"
set dstaddr " A_VLAN2" " B_VLAN2"
set action accept
set schedule " always"
set service " ALL"
next
FortiGate policies are identical at both offices to allow packet in and out for 192.168.100.0/24 and 192.168.101.0/24, which works fine.
Office B:
edit 2
set srcintf " internal1"
set dstintf " B_TO_A"
set srcaddr " B VPN Group"
set dstaddr " A VPN Group"
set action accept
set schedule " always"
set service " ALL"
next
edit 3
set srcintf " B_TO_A"
set dstintf " internal1"
set srcaddr " A VPN Group"
set dstaddr " B VPN Group"
set action accept
set schedule " always"
set service " ALL"
next
edit 13
set srcintf " Voice"
set dstintf " internal1"
set srcaddr " B_VLAN2" " A_VLAN2"
set dstaddr " A LAN" " B LAN"
set action accept
set schedule " always"
set service " ALL"
next
edit 14
set srcintf " internal1"
set dstintf " Voice"
set srcaddr " A LAN" " B LAN"
set dstaddr " B_VLAN2" " A_VLAN2"
set action accept
set schedule " always"
set service " ALL"
next
FortiGate policies are identical at both offices to allow packet in and out for 10.10.10.0.0/24, 10.10.20.0/24, which does not work.
From the Office A FortiGate
Diag sniffer packet internal “host 10.10.20.100†doesn’t show any ICMP requests, or maybe 10 per hour even though I’m sending them via a windows command prompt –t constantly (0 dropped by kernel). I gather this means the requests aren’t even hitting the FortiGate internal interface, which is odd since it’s setup the same as Office B, which behaves as you would expect minus traffic going across the tunnel.
From the Office B FortiGate
Diag sniffer packet internal “host 10.10.10.100†shows all ICMP requests sent (but no reply) thouI’m sending them via a windows command prompt –t constantly
Everything at Office A works fine. Phones get DHCP from the PBX DHCP server and work great.
Office B phones registering as LLDP devices, but obviously no DHCP from the Office A PBX DHCP server.
Any help would be greatly appreciated.
