fortigate-ipsec-40-mr3

Gateway-to-gateway configurations How to work with overlapping subnets
Figure 9: Overlapped subnets example
PC 1
10.11.101.10
Finance network
10.11.101.0/24
(VIP 10.21.101.0/24)
Solution for route-based VPN
Port t 1111
Port 2
172.16.20.1
FortiGate_1
Fo Fo Fo Foo Fort rt rt rtiG tiG
iG iG iG iGatt at at at ateeeee_ e_1
FGT1_to_FGT2
VPN tunnel
Port 2
172.16.30.1
FortiGate_2
Fo Fo FFo Fo Fort rt rt rt rtiG iG iG iGG iGat at at at ateeeee
You need to:
Configure IPsec Phase 1 and Phase 2 as you usually would for a route-based VPN. In
this example, the resulting IPsec interface is named FGT1_to_FGT2.
Configure virtual IP (VIP) mapping:
the 10.21.101.0/24 network mapped to the 10.11.101.0/24 network on FortiGate_1
the 10.31.101.0/24 network mapped to the 10.11.101.0/24 network on FortiGate_2
Configure an outgoing security policy with ordinary source NAT on both FortiGates.
Configure an incoming security policy with the VIP as the destination on both
FortiGates.
Configure a route to the remote private network over the IPsec interface on both
FortiGates.
To configure VIP mapping on both FortiGates
1 Go to Firewall Objects > Virtual IP > Virtual IP.
2 Select Create New, enter the following information, and select OK:
Name Enter a name, for example, my_vip.
External Interface
Select FGT1_to_FGT2.
The IPsec interface.
Type Static NAT
External IP
Address/Range
For the external IP address field enter:
10.21.101.1 when configuring
FortiGate_1, or
10.31.101.1 when configuring
FortiGate_2.
HR network
10.11.101.0/24
(VIP 10.31.101.0/24)
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 77
http://docs.fortinet.com/
PPPo Port 1
PC 2
10.11.101.10