Tag (802.1q) VLAN' s through IPSec tunnel

[TopJimmy]

Our corp site is connected to a remote site and the need to have the same VLAN' s be live on both ends has arisen. Is it possible to tag a few VLAN' s from one site to another across the IPSec tunnel. Both ends are FortiGates running 4.3.14

[emnoc]

This questions comes up once very few blue moons. The ipsec ona fortigate is a layer3 function ( network/routing ), what you need is either a L2TPv3 or MPLS or even GRE-bridging. None of the above are available over a IPSEC. What you might want to do; create two internet devices that bridges the networks between siteA &B and carry this traffic over the ipsec tunnel +FGT. The real question; what' s driving the need for the same subnet available at the 2 sites? I would guess this is a poor design that would lead to further complications down the road.

[TopJimmy]

Disaster recovery. We are a VMWare heavy IT department and all of our data/servers are replicated nightly to a DR location (remote site). In the event of a disaster or even a server failure, our goal is bring up the server(s) in question at the DR without having to re-ip them. I' m open to suggestions if you have any. This is new territory for me.

[emnoc]

Are you using SRM? and if not why ? and that would cover your DR deployment.

[TopJimmy]

Sorry...forgot to mention we' re using EMC' s Recover Point Appliance to replicate our SAN which still wouldn' t allow the same subnets at both ends.