FortiGate IPSec VPN User Guide - FirewallShop.com

How to work with overlapping subnets
Gateway-to-gateway configurations
To define the local private network firewall address
1 Go to Firewall > Address.
2 Select Create New and enter the following information:
Address Name Enter a name, vpn-local, for example.
Type
Subnet / IP Range
Subnet / IP Range 192.168.2.0 255.255.255.0
Interface
Any
To define the remote private network firewall address
1 Go to Firewall > Address.
2 Select Create New, enter the following information and select OK:
Address Name
Type
Subnet / IP Range
Interface
Enter a name, vpn-remote, for example.
Subnet / IP Range
10.0.2.0 255.255.255.0 on FortiGate_1
10.0.1.0 255.255.255.0 on FortiGate_2
Any
To configure the IPSec firewall policy
In the CLI, enter the following commands:
config firewall policy
edit 1
set srcintf "port1"
set dstintf "port2"
set srcaddr "vpn-local"
set dstaddr "vpn-remote"
set action ipsec
set schedule "always"
set service "ANY"
set inbound enable
set outbound enable
set vpntunnel "FG1toFG2"
set natoutbound enable
set natip 10.0.1.0 255.255.255.0 (on FortiGate_1)
set natip 10.0.2.0 255.255.255.0 (on FortiGate_2)
end
Optionally, you can set everything except natip in the web-based manager and
then use the CLI to set natip.
FortiGate IPSec VPN Version 3.0 User Guide
32 01-30005-0065-20070716