Routing between two routers behind NAT via a non NAT router

[rharrison]

I have two networks 172.20.1.0/24 & 172.20.2.0/24 both behind NAT routers with 60E's connected to those routers. I have configured SITE to SITE ipsec for the corporate network on a static IP 100D routing  172.18.0.0/16 for both SITES and this works fine.

But now I would like to ping SITE 1 172.20.1.1 from SITE 2 172.20.2.1 and I'm not sure if I can config something up on the PHASE2 connectors at each site to allow the packets to flow between the two NATed routers via the static IP Router. 

See diagram attached

[Dai · Accepted solution]

Hi. Follow the steps below to check if a packet can be received by the device. <Configured on each device> Trusted Host 172.20.1.0 / 255.255.255.0 Trusted Host 172.20.2.0 / 255.255.255.0 [link]https://kb.fortinet.com/k...nk.do?externalID=10868[/link] <SITE 2 Fortigate> Firstly make sure you are not pinging 172.20.1.1 <SITE 1 Fortigate> Connect to the FortiGate CLI then type the following commands:   diag debug flow filter saddr 172.20.2.1 diag debug flow show console enable diag debug enable diag debug flow trace start 10 <SITE 2 Fortigate> Once this is done start pinging 172.20.1.1 Observe the FortiGate CLI output. 1) what route/interface the packets match. 2) what policy it hit.

[rharrison]

Thanks for this Dai