Two site-to-site IPsec and overlapping remote subnets

[Hasselmusen]

I just migrated to Fortigate, and I have 12 IPsec tunnels to different sites.

Site A and Site B has the same remote subnet, and this is a problem because I can only have the same static route to the subnet once.

Is this solvable from within the Fortigate?

[James_G]

I assume site a and site b are client subnets, and servers are in central site, say site c, then it can be resolved by implementing NAT to hide the duplicated vlans at site a and b. More info on requirement would help, but yes I expect something is possible.

[Hasselmusen]

Thanks for your reply James, but I digged a bit deeper into the forums and found this thread: https://forum.fortinet.com/tm.aspx?m=138688

And that is the issue that I have and the solution to the problem. It really isn't simple to fix so we're going to change the subnet instead.

[Hasselmusen]

Or, maybe I'll just set it up as a Policy based VPN.

Does Fortigate support Policy based VPNs to coexist with Route based VPNs?

I can enable Policy based VPNs under Advanced Features, but I want to make sure it does not screw up the already established Route based ones that I have.

[rwpatterson]

Hasselmusen wrote:

And that is the issue that I have and the solution to the problem. It really isn't simple to fix so we're going to change the subnet instead.

Always the best option, aside form not starting with commonly used default subnets. (192.168.0.0/24, 192.168.1.0/24, etc...)

[Hasselmusen]

Turns out I couldn't use Policy based VPNs. Well, I can, but it would require to make both VPNs with the same remote subnet policy based ones, and thus bring down the already working one, which is not an option for now.

Since there is a static route for the remote subnet already working and implemented, then creating a policy based VPN for the other VPN with the same remote subnet does not resolve my issue, because traffic that should have hit the policy based VPN still goes to the static route.