Access a remote site across two site-to-site IPSEC tunnels

[Alex_K]

Hi!

I have a site-to-site VPN setup to our client from location A. I want to be able to access client's network from location B through existing tunnels: B->A->Client. There is no tunnel between location B and the client, only between locations A and B. Locations A and B use 100D firewalls.

What would be the recommended approach?

Thank you in advance.

[Alex_K]

azh wrote:

Hello, 

What device are u using in client side ? 

You can try use FG100D(location A) as a next-hope router for client and FG100D(location B).  And include client subnets for FG100D(location B) and vice versa, also don't forget to configure policies and routes for that. 

Br, A 

I have no knowledge of what being used on client's end. I can probably find out, but since there are quite a few tunnels with different clients are setup, I need a universal solution.

Essentially, I did what you recommended me to do but still didn't get it to work. When I do the packet capture, it shows that the packet is coming back, but it has the external IP of Location A as its source address. I played around with policy routes, but still nothing. Here's more details about how it is setup:

Location A: 10.100.0.0/16

Location B: 10.101.0.0/16

Client: 10.2.100.0/24

Location B

Phase 2: 1) Remote Net: 10.100.0.0/16 Local Net: 10.101.0.0/16

               2) Remote Net: 10.2.100.0/24 Local Net: 10.101.0.0/16

IP4 Policy: Allow all 10.100.0.0/16 and 10.2.100.0/24 traffic

Static route: 10.2.100.0 via VPN tunnel to location A

Location A:

Phase 2: 1) Remote Net: 10.101.0.0/16 Local Net: 10.100.0.0/16

               2) Remote Net: 10.101.0.0/16 Local Net: 10.2.100.0/24

Static route: 10.101.0.0 via VPN tunnel to location B

Static route: 10.2.100.0 via VPN tunnel to Client

IP4 Policy: Allow all 10.101.0.0/16

[kallbrandt]

Hello,

This should be fixable, it is just routing and rules.

Just throwing out a few things:

Are all the networks in this setup routed in the firewalls or somewhere else?

If any of the networks are routed elsewhere, you need to check the routing table in those routers.

If you traceroute from the B network to the client network behind A, where does it fail?

Do it the other way around - Client network towards 10.101.0.0/16?

Traceroute from one router/fw to another?

Are you using zones?

If so, are the IPsec interfaces in the correct zone?

[naama]

as usual you have to configure the below:

Phase1 , phase2, static route, Policy.

all configuration must be done similar in both side .

what ever you want other party to access must be added in phase2 and policy.

Just focus on Nat traversal in phase 1, PFS in phase 2 and Nat pool in policy , most of issues appears as a result of unmatched configuration on them.