Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

Two customers with overlapping IP subnets connected through IPsec



we have two customers that both use the same local network connected to our FortiGate VM through IPsec. We want to send to and receive traffic from both customers through one VM interface. (There is no direct traffic between the customer networks.)


To solve this problem, one would intuitively perform DNAT by assigning to one customer and to the other. Now the problem is that DNAT is handled before routing, so we cannot use a VIP-based approach that maps and to We would need to perform DNAT after routing.


How would one solve this issue?


Thank you very much in advance.

Esteemed Contributor III

I think the same/similar situation was posted recently. In those cases generally the DNAT needs to be performed on the destination side (customer side). If that's not an option like the privious poster's case, you have to do something really complicated like the KB I referred to in the thread with VDOM+VRF.



Top Kudoed Authors