VPN Site-to-site with Overlapping Subnets in Fortigate

 Thanks to: https://docs.fortinet.com/

Site-to-site VPN with overlapping subnets

This is a sample configuration of IPsec VPN to allow transparent communication between two overlapping networks that are located behind different FortiGates using a route-based tunnel with source and destination NAT.

In the following topology, both FortiGates (HQ and Branch) use 192.168.1.0/24 as their internal network, but both networks need to be able to communicate to each other through the IPsec tunnel.

New virtual subnets of equal size must be configured and used for all communication between the two overlapping subnets. The devices on both local networks do not need to change their IP addresses. However, the devices and users must use the new subnet range of the remote network to communicate across the tunnel.

Configuring the HQ FortiGate

To configure IPsec VPN:

1. Go to VPN > IPsec Wizard and select the Custom template.
2. Enter the name VPN-to-Branch and click Next.
3. For the IP Address, enter the Branch public IP address (172.25.177.46), and for Interface, select the HQ WAN interface (wan1).

   

4. For Pre-shared Key, enter a secure key. You will use the same key when configuring IPsec VPN on the Branch FortiGate.

   

5. In the Phase 2 Selectors section, enter the subnets for the Local Address (10.1.1.0/24) and Remote Address (10.2.2.0/24).

   

6. Optionally, expand Advanced and enable Auto-negotiate.

   

7. Click OK.

To configure the static routes:

1. Go to Network > Static Routes and click Create New.
2. In the Destination field, enter the remote address subnet (10.2.2.0/24).
3. For Interface, select the VPN tunnel you just created, VPN-to-Branch.

   

4. Click OK.
5. Create another route with the same Destination, but change the Administrative Distance to 200 and for Interface, select Blackhole. This is a best practice for route-based IPsec VPN tunnels because it ensures traffic for the remote FortiGate's subnet is not sent using the default route in the event that the IPsec tunnel goes down.

   

To configure the address objects:

1. Go to Policy & Objects > Addresses and click Create New > Address.
2. For Name, enter HQ-original.
3. For IP/Netmask, enter the original LAN subnet of HQ (192.168.1.0/24).
4. For Interface, select the LAN-side interface (internal).

   

5. Click OK
6. Create another address object named Branch-new, but for IP/Netmask, enter the new LAN subnet of Branch (10.2.2.0/24), and select the VPN interface (VPN-to-Branch).

   

To configure the IP pool:

1. Go to Policy & Objects > IP Pools and click Create New.
2. For Name, enter HQ-new.
3. For Type, select Fixed Port Range.
4. Enter the External IP address/range (10.1.1.1 – 10.1.1.254, the new HQ subnet) and Internal IP Range (192.168.1.1 – 192.168.1.254, the original HQ subnet).

   

5. Click OK.

To configure the VIP:

1. Go to Policy & Objects > Virtual IPs and click Create New > Virtual IP.
2. For Name, enter HQ-new-to-original.
3. For Interface, select the VPN interface (VPN-to-Branch).
4. Enter the External IP address/range (10.1.1.1 – 10.1.1.254, the new HQ subnet) and Mapped IP address/range (192.168.1.1 – 192.168.1.254, the original HQ subnet).

   

5. Click OK.

To configure the firewall policy for traffic from HQ to Branch:

1. Go to Policy & Objects > Firewall Policy and click Create New.
2. For Name, enter From-HQ-to-Branch.
3. For Incoming Interface, select the LAN-side interface (internal).
4. For Outgoing Interface, select the VPN tunnel interface (VPN-to-Branch).
5. For Source, select HQ-original.
6. For Destination, select Branch-new.
7. For Service, select ALL.
8. Enable NAT.
9. Select Use Dynamic IP Pool and select the HQ-new IP pool.

   

10. Click OK.

To configure the firewall policy for traffic from Branch to HQ:

1. Click Create New and for Name, enter From-Branch-to HQ.
2. For Incoming Interface, select the VPN tunnel interface (VPN-to-Branch).
3. For Outgoing Interface, select the LAN-side interface (internal).
4. For Source, select Branch-new.
5. For Destination, select the HQ-new-to-original VIP.
6. For Service, select ALL.
7. Disable NAT.

   

8. Click OK.

Configuring the Branch FortiGate

To configure IPsec VPN:

1. Go to VPN > IPsec Wizard and select the Custom template.
2. Enter the name VPN-to-HQ and click Next.
3. For the IP Address, enter the HQ public IP address (172.25.176.142), and for Interface, select the Branch WAN interface (wan1).

   

4. For Pre-shared Key, enter the matching secure key used in the VPN-to-Branch tunnel.

   

5. In the Phase 2 Selectors section, enter the subnets for the Local Address (10.2.2.0/24) and Remote Address (10.1.1.0/24).

   

6. Optionally, expand Advanced and enable Auto-negotiate.

   

7. Click OK.

To configure the static routes:

1. Go to Network > Static Routes and click Create New.
2. In the Destination field, enter the remote address subnet (10.1.1.0/24).
3. For Interface, select the VPN tunnel you just created, VPN-to-HQ.

   

4. Click OK.
5. Create another route with the same Destination, but change the Administrative Distance to 200 and for Interface, select Blackhole.

   

To configure the address objects:

1. Go to Policy & Objects > Addresses and click Create New > Address.
2. For Name, enter Branch-original.
3. For IP/Netmask, enter the original LAN subnet of Branch (192.168.1.0/24).
4. For Interface, select the LAN-side interface (lan).

   

5. Click OK
6. Create another address object named HQ-new, but for IP/Netmask, enter the new LAN subnet of HQ (10.1.1.0/24), and select the VPN interface (VPN-to-HQ).

   

To configure the IP pool:

1. Go to Policy & Objects > IP Pools and click Create New.
2. For Name, enter Branch-new.
3. For Type, select Fixed Port Range.
4. Enter the External IP address/range (10.2.2.1 – 10.2.2.254, the new Branch subnet) and Internal IP Range (192.168.1.1 – 192.168.1.254, the original Branch subnet).

   

5. Click OK.

To configure the VIP:

1. Go to Policy & Objects > Virtual IPs and click Create New > Virtual IP.
2. For Name, enter Branch-new-to-original.
3. For Interface, select the VPN interface (VPN-to-HQ).
4. Enter the External IP address/range (10.2.2.1 – 10.2.2.254, the new Branch subnet) and Mapped IP address/range (192.168.1.1 – 192.168.1.254, the original Branch subnet).

   

5. Click OK.

To configure the firewall policy for traffic from Branch to HQ:

1. Go to Policy & Objects > Firewall Policy and click Create New.
2. For Name, enter From-Branch-to-HQ.
3. For Incoming Interface, select the LAN-side interface (lan).
4. For Outgoing Interface, select the VPN tunnel interface (VPN-to-HQ).
5. For Source, select Branch-original.
6. For Destination, select HQ-new.
7. For Service, select ALL.
8. Enable NAT.
9. Select Use Dynamic IP Pool and select the Branch-new IP pool.

   

10. Click OK.

To configure the firewall policy for traffic from HQ to Branch:

1. Click Create New and for Name, enter From-HQ-to-Branch.
2. For Incoming Interface, select the VPN tunnel interface (VPN-to-HQ).
3. For Outgoing Interface, select the LAN-side interface (lan).
4. For Source, select HQ-new.
5. For Destination, select the Branch-new-to-original VIP.
6. For Service, select ALL.
7. Disable NAT.

   

8. Click OK.

To verify the communication across the tunnel:

1. Go to Dashboard > Network and click the IPsec widget to expand to full screen view. The tunnels should be up on both FortiGates. If you did not enable Auto-negotiate in the IPsec VPN settings, you may have to select the tunnel and click Bring Up.
2. From a PC on the HQ network, ping a PC on the Branch network using the new IP for the Branch PC. The ping should be successful.

   

3. From a PC on the Branch network, ping a PC on the HQ network using the new IP for the HQ PC. The ping should be successful.