FortiGate IPSec VPN User Guide - FirewallShop.com

Gateway-to-gateway configurations
How to work with overlapping subnets
How to work with overlapping subnets
A site-to-site VPN configuration sometimes has the problem that the private
subnet addresses at each end are the same. You can resolve this problem by
remapping the private addresses using virtual IP addresses (VIP).
Figure 5:
Overlapped subnets example
PC1 192.168.2.100 PC2 192.168.2.100
Internet
192.168.2.0/24
(VIP 10.0.1.0/24)
Port1
Port 2
172.16.20.1
FortiGate_1
Port 2
172.16.30.1
FortiGate_2
Port1
192.168.2.0/24
(VIP 10.0.2.0/24)
After the tunnel is established, hosts on each side can communicate with hosts on
the other side using the mapped IP addresses. For example, PC1 can
communicate with PC2 using IP address 10.0.2.100. FortiGate_2 maps
connections for IP address 10.0.2.100 to IP address 192.168.2.100.
Solution for route-based VPN
You need to:
• Configure IPSec Phase 1 and Phase 2 as you usually would for a route-based
VPN. In this example, the resulting IPSec interface is named FG1toFG2.
• Configure virtual IP (VIP) mapping:
• the 10.0.1.0/24 network to the 192.168.2.0/24 network on FortiGate_1
• the 10.0.2.0/24 network to the 192.168.2.0/24 network on FortiGate_2
• Configure an outgoing firewall policy with ordinary source NAT.
• Configure an incoming firewall policy with the VIP as the destination.
• Configure a route to the remote private network over the IPSec interface.
To configure VIP mapping
1 Go to Firewall > Virtual IP.
2 Select Create New, enter the following information, and select OK:
Name
External Interface
Type
External IP Address/Range
Enter a name, for example, my-vip.
Select the IPSec interface: FG1toFG2
Static NAT
In the first field, enter:
10.0.1.1 on FortiGate_1
10.0.2.1 on FortiGate_2.
Mapped IP Address/Range Enter 192.168.2.1 and 192.168.2.254.
Port Forwarding
Disable
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 29