port-forwarding-through-an-ipsec-tunnel-to-a-remote-serverpc-with-fortinet doesnt work

[flanker657614]

Hi all

I have two site

SiteA Fortinet A

--- WAN1: 55.55.55.20

----WAN2: 172.18.254.1

--- Int1: 10.20.1.1 --- Port 3394 should be forwarded from WAN1 to 10.10.1.17 in Site B SiteB Fortinet B

--- WAN1: 66.66.66.60

----WAN2:172.18.254.2

---- Int1: 10.10.1.1

--- Server on 10.10.1.17 port 3389 open and ready

I create vpn  using siteA WAN2 and siteB WAN2. Its work

Now  need when users connect to siteA WAN1 port 3389  there was redirect through ipsec vpn to siteB to server 10.10.10.17

I create Ip virtual and ip policy. But it doesnt work.

   

Can anyone help me?

[emnoc]

With out seeing the cfg it;s hard to say. Are you needing a VIP { DNAT  } at siteB?  If the address are  rfc1918 why do you think you need a VIP?

[Toshi_Esumi · Accepted solution]

I think the users are coming from outside hitting SiteA wan1 and vipped to SiteB via wan2. Then two potential problems: a) phase2 selector doesn't include the source IP, which could be avoided by using the default (0/0<->0/0) for the selector, and b) routing back from B->A for the source, which is not too easy to solve unless the default route at SiteB is pointing into the tunnel to go out via SiteA. Needs SNAT on the sources.

But I would set a VIP at SiteB and let users to use SiteB's WAN1 for RDP for simplicity. 

[flanker657614]

Thank you. So in the end they did.