NAT packets through ipsec tunnel

[mdf]

Hello ;) ,   this is my first post and I need some help with configuration.   I will try to quickly explain:

On Fortigate1 there is LAN 10.12.0.0/16. Fortigate2 has 10.17.17.0/24 LAN (port1) FGT1 & FGT2 are connected via a IPSec VPN connection and on FGT2 I have second subnet on port2 (192.168.40.0/24) What policy I must add to route traffic from 192.168.40.0/24 to the remote LAN (10.12.0.0/16) on Fortigate1 ? I want to go out from LAN 192.168.40.0/24 on FG2 as IP from pool 10.17.17.0/24 and then into the tunnel to reach LAN 10.12.0.0/16 on FG1. I tried add NAT rule (on FG2) from LAN-192.168.40.0/24 to IPSEC TUNNEL INTERFACE but it's not working. Perhaps because it already exists rule to NAT 192.168.40.0/24 to WAN interface on FG2. P.S. I don't wanna change tunnel addresses on both sides. Users from 192.168.40.0/24 must ping 10.12.0.0/16 addresses without adding static routes on theirs PC.

Please help!

Thanks a lot!

Mike

[EMES]

Using an IP pool should work, can you show us what you've configured.

[mdf]

Eugene.milon wrote:
Using an IP pool should work, can you show us what you've configured.

Thanks for reply. Here's my config:

Fortigate1: vdom-root wan1  2.2.2.30/24 lan ip 10.12.0.100/24  255.0.0.0 Policy:

#1

srcintf "lan" dstintf "wan1" srcaddr "all" dstaddr "all" action accept schedule "always" service "ALL" nat enable #2 srcintf "lan" dstintf "vpn-1" srcaddr "vpn-1_local" dstaddr "vpn-1_remote" action accept schedule "always" service "ALL" #3 srcintf "vpn-1" dstintf "lan" srcaddr "vpn-1_remote" dstaddr "vpn-1_local" action accept schedule "always" service "ALL"          router static gateway 2.2.2.20 device "wan1" dst 10.17.17.0 255.255.255.0 device "vpn-1"

"vpn-1_local" 10.12.0.0 255.255.0.0 "vpn-1_remote" 10.17.17.0 255.255.255.0 Fortigate2: vdom-root wan1  1.1.1.28/24 lan ip 10.17.17.100/24  255.255.255.0 Policy:

#1 srcintf "lan" dstintf "wan1" srcaddr "all" dstaddr "all" action accept schedule "always" service "ALL" nat enable #2    srcintf "lan" dstintf "vpn-1" srcaddr "vpn-1_local" dstaddr "vpn-1_remote" action accept schedule "always" service "ALL" #3   srcintf "vpn-1" dstintf "lan" srcaddr "vpn-1_remote" dstaddr "vpn-1_local" action accept schedule "always" service "ALL"          router static gateway 1.1.1.25 device "wan1" dst 10.12.0.0 255.255.0.0 device "vpn-1"

"vpn-1_local" 10.17.17.0 255.255.255.0 "vpn-1_remote" 10.12.0.0 255.255.0.0 vdom-lan LAN-192.168.40.100/24 wan2 1.1.1.29/24 firewall policy #1    srcintf "LAN" dstintf "wan2" srcaddr "all" dstaddr "all" action accept schedule "always" service "ALL" nat enable   IPSEC Site-to-site configured as standard without NAT traversal.

[EMES]

It looks like you have two VDOMs on FGT2. You need to route the traffic across the VDOMs first using VDOM links. When you seperate the firewall logically then the two vdoms dont know anything about each other. The following article should help  http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-virtual-domains-54/4-Inter-VDOM-routi... . You would then create the following IP Pool and then add a policy for vdom link to vpn1 on FGT2-vdom root. you will also need policies allowing lan to vdom link on fgt2 vdom LAN. Its a little more complicated with multiple VDOMS.

config firewall ippool

edit "IPsec NAT"

set startip <unused IP in 10.17.17.0/24>

set endip <same IP as above>

next

Now you would create a security policy with the following

srcintf "lan" dstintf "vpn-1" srcaddr "192.168." dstaddr "vpn-1_remote" action accept schedule "always" service "ALL"

[mdf]

I first created a vdom-link between 2 vdoms, added policies and static route, and in vdom-root I added a policy - FROM inter-vdom-link TO the VPN tunnel with NAT. I also added in vdom-root IP POOL - 10.17.17.100 (overload) and everything works great. EMES thank you very much for your help.

Best Regards

Mike