I have a few remote offices running Cisco 800 Routers and a HQ that is running a Fortigate 80D and an Azure Cloud enviroment that has a VPN Tunnel to the Fortigate.

Now, I have setup IPSec VPN's between all the remote offices and the Fortigate at HQ but I'm having difficulty routing the traffic from the remote sites throught to the Azure enviroment.

Remote site 1 Cisco - 192.168.66.x

HQ Fortigate - 192.168.89.x

Azure - 10.0.0.x

I'm new to newotking so have been strugling with this for a few days now.

Thanks in advance.

  • 2
    Could you please post the configuration of the devices? Without that, we'd simply be making wild guesses/suggestions. Commented Sep 30, 2014 at 17:13
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 10, 2017 at 15:36

1 Answer 1


Considering you have the IPSec tunnels up and running, that's half the battle, the other half is getting your Fortinet HQ to act as an Internet transport "between" hubs.

With the Forinet you can use either the Policy-Based or Route-Based VPN to enable communication between the spokes.

For a Policy-Based hub-and-spoke VPN, you define a concentrator to enable communication between the spokes.

To define the VPN concentrator 1. At the hub, go to VPN > IPsec > Concentrator and select Create New. 2. In the Concentrator Name field, type a name to identify the concentrator. 3. From the Available Tunnels list, select a VPN tunnel and then select the right-pointing arrow. 4. Repeat Step 3 until all of the tunnels associated with the spokes are included in the concentrator. 5. Select OK.

For a Route-Based hub-and-spoke VPN allowing communication between ONLY two spokes.

• Create a security policy for each pair of spokes that are allowed to communicate with each other. The number of policies required increases rapidly as the number of spokes increases.

To enable communication between two spokes, you need to define an ACCEPT security policy for them. To allow either spoke to initiate communication, you must create a policy for each direction. This procedure describes a security policy for communication from Spoke 1 to Spoke 2. 1. Define names for the addresses or address ranges of the private networks behind each spoke. For more information, see “Defining policy addresses” on page 59. 2. Go to Policy & Objects > Policy > IPv4 and select Create New. 3. Leave the Policy Type as Firewall and leave the Policy Subtype as Address. 4. Enter the settings and select OK.

"Incoming Interface" Select the IPsec interface that connects to Spoke 1. "Source Address" Select the address of the private network behind Spoke 1. "Outgoing Interface" Select the IPsec interface that connects to Spoke 2. "Destination Address" Select the address of the private network behind Spoke 2. "action" Select ACCEPT. "Enable NAT" Enable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.