Two customers with overlapping IP subnets connected through IPsec

[ble]

Hello,

we have two customers that both use the same local network 192.168.0.0/16 connected to our FortiGate VM through IPsec. We want to send to and receive traffic from both customers through one VM interface. (There is no direct traffic between the customer networks.)

To solve this problem, one would intuitively perform DNAT by assigning 10.0.0.0/16 to one customer and 10.1.0.0/16 to the other. Now the problem is that DNAT is handled before routing, so we cannot use a VIP-based approach that maps 10.0.0.0/16 and 10.1.0.0/16 to 192.168.0.0/16. We would need to perform DNAT after routing.

How would one solve this issue?

Thank you very much in advance.

[Toshi_Esumi]

I think the same/similar situation was posted recently. In those cases generally the DNAT needs to be performed on the destination side (customer side). If that's not an option like the privious poster's case, you have to do something really complicated like the KB I referred to in the thread with VDOM+VRF.
https://community.fortinet.com/t5/Support-Forum/Multiple-IPsec-tunnels-with-overlapping-networks-VIP...

Toshi