VXLAN under SDWAN IPsec over NAT

[HT_JDC]

Hello Experts,

In site-to-site VXLAN under SDWAN IPsec over NAT,

does Fortigate at NAT outside need to specify WAN IP address of the other Fortigate?

Here is my network environment.

   Inside    Outside 

|---| -- NAT1 -- |--------| --- |---|
|FG1|            |Internet|     |FG2|
|---| -- NAT2 -- |--------| --- |---|

   Inside    Outside 

Both network I/F of FG2 are configured as "Dialup User".
FG2 does not know WAN IP address of FG1 before FG1 connects to FG2.
In order to establish VXLAN between FG1 and FG2, after getting FG1 network I/F IP addresses
I needed to specify static route to the IP addresses at FG1.

Are there any other solutions?

Any comments are appreciated.

[Sx11]

The guide states the following:

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/247006/vxlan-over-ipsec-usin...

The hub FortiGate inserts a reverse route pointing to newly established tunnel interfaces for any of the subnets that the spoke FortiGate's source quick mode selectors provides. This is why you should set the tunnel IP address here.

Might be worth to use dynamic routing:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dynamic-dial-up-VPN-with-OSPF/ta-p/197156

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-deploy-dial-up-IPsec-VPN-in-SDWAN-u...

[HT_JDC]

Hello SX11,

Thanks for your comments.

I looked at all URLs.

Excuse me again. Thus, I should specify the remote tunnel address at FG2 (NAT outside).

Is it correct?

Any comments are appreciated.

[Sx11 · Accepted solution]

Yes, in this case you need to specify the tunnel IP address of the other FGT.

[HT_JDC]

Hello sx11,

Thanks for your reply. I understood it.