multiple sites to one HQ with vpn

[Raffael_Hotz]

hello there,

I am wondering if it is possible to get multiple sites connected to one HQ with VPN. As i only see the Site-to-Site wizard, where you have to say what is the IP of the branche office, I am not sure how to do that. DO i just need to redo the same wizward, with the same local IP but different branche IP?

Thanks,

Raffael

[Toshi_Esumi · Accepted solution]

It's a very common variation of Site-to-Site, called "hub and spoke". When you search "Fortigate hub and spoke VPN configuration" on the internet, or in this Forum, you can find many examples including cookbook, online help, and KB.

In hub and spoke topology, you have to take care of phase2 traffic selectors and routing issues if you want to connect a remote site to another remote site via Hub/HQ to accommodate traffic not only between a remote to the HUB/HQ. Those examples show how. 

[Raffael_Hotz]

Hi Toshi.

Thank you for your answer. That was what I am looking for. So for a centralized monitoring I don't need anything else than the Hub n Spoke configuration?

Thanks,

Raffa

[Toshi_Esumi]

Do you mean monitoring VPNs or devices at remote locations? For the former, logging at HQ FGT would tell you all events on all VPNs. For the latter, if you(or a monitoring device) are at the HQ, you should have access/reachability to each location over each "site-to-site" vpn. So you can monitor whatever you want to monitor.