Site to site vpn between 2 FGTs

[rezafathi]

Hi

We want to setup site to site vpn between our fgt(200f) and our branch fgt (200e) . Hq fgt version is 7.6 and branch version is 6. We want to connect to only one server from branch and they will connect to one of servers too. In HQ, we have subnet overlapping when i want to insert remote ip but on the branch side they do not have any overlapping problem. How can i solve that?

[hjezzapaula]

Hi,

You may follow on below KB and just follow the VIP configuration on the peer with overlapping subnet.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-IPsec-tunnel-with-Over...

[rezafathi]

Thanks,

What is the difference between these two tutorials?

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://docs.fortinet.com/document...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-IPsec-tunnel-with-Over...

[kmohan]

Hi Rezafathi
Both are same

Its a documentation from the Firmware Release Notes:
https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/426761/site-to-site-vpn-with...

It's a KB articles was created by one of Technical Engineer, and tested in our environment

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/426761/site-to-site-vpn-with...

[rezafathi]

Thanks. In one of them uses nat for both directions but in another it only uses nat for outgoing direction. I am confused

[kmohan]

Hi Rezafathi

Follow the kb articles:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-IPsec-tunnel-with-Over...

Inbound traffic and outband traffic with VIP configuration they have enable NAT  on the Kb articles:


In the Documentation there is not VIP mentioned on the Policy, so it's not added.

[rezafathi]

Why there is no ip pool configured in kb? Also vip is mentioned on other document.