All our offices are fortigates on 6.x firmware connected via IPSEC
tunnels. Each office has its own unique LAN subnet, but also has a
unique DHCP-based subnet strictly for wifi clients. NAT-based policy in
each direction routes wifi clients back to t...
Eureka! Pretty sure I have this working now, but not exactly as one
would think. Making both the IPSEC phase 2 selectors 0.0.0.0/0 was
apparently a key tenet for policy subnets to traverse the tunnel, so
thanks for that! Ended up making an additional...
OK, additional question time. Is this all assuming that I take NAT off
the wifi<->LAN policies in each office and make them also static?
Instead of an address group, couldn't I just add the applicable subnet
addresses to each tunnel policy (add wifi ...
