FortiGate IPSec VPN User Guide - FirewallShop.com

Gateway-to-gateway configurations
How to work with overlapping subnets
Solution for policy-based VPN
As with the route-based solution, users contact hosts at the other end of the VPN
using an alternate subnet address. PC1 communicates with PC2 using IP address
10.0.2.100. PC2 communicates with PC1 using IP address 10.0.1.100. In this
solution however, outbound NAT is used to translate the source address of
packets from the 192.168.2.0/24 network to the alternate subnet address that
hosts at the other end of the VPN use to reply. Inbound packets from the remote
end have their destination addresses translated back to the 192.168.2.0/24
network.
For example, PC1 uses the destination address 10.0.2.100 to contact PC2.
Outbound NAT on FortiGate_1 translates the PC1 source address to 10.0.1.100.
At the FortiGate_2 end of the tunnel, the outbound NAT configuration translates
the destination address to the actual PC2 address of 192.168.2.100. Similarly,
PC2 replies to PC1 using destination address 10.0.1.100, with the PC2 source
address translated to 10.0.2.100. PC1 and PC2 can communicate over the VPN
even though they both have the same IP address.
You need to:
• Configure IPSec Phase 1 as you usually would for a policy-based VPN.
• Configure IPSec Phase 2 with the use-natip disable CLI option.
• Define a firewall address for the local private network, 192.168.2.0/24.
• Define a firewall address for the remote private network:
• define a firewall address for 10.0.2.0/24 on FortiGate_1
• define a firewall address for 10.0.1.0/24 on FortiGate_2
• Configure an outgoing IPSec firewall policy with outbound NAT to map
192.168.2.0/24 source addresses:
• to the 10.0.1.0/24 network on FortiGate_1
• to the 10.0.2.0/24 network on FortiGate_2
To configure IPSec Phase 2
In the CLI, enter the following commands:
config vpn ipsec phase2
edit "FG1FG2_p2"
set keepalive enable
set pfs enable
set phase1name FG1toFG2
set proposal 3des-sha1 3des-md5
set replay enable
set use-natip disable
end
In this example, your phase 1 definition is named FG1toFG2. Because
use-natip is set to disable, you can specify the source selector using the
src-addr-type, src-start-ip / src-end-ip or src-subnet keywords.
This example leaves these keywords at their default values, which specify the
subnet 0.0.0.0/0.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 31