Ipsec site to site Vpn

Question

I need to communicate for three sites through vpn. For below scenario,

is possible to reach 10.33.209.xx/27 from 192.168.60.xx.

please give any idea to communicate in three segment.

Answer 1

This is a so called hub and spoke configuration, if you are using Fortigate appliances, then you can follow this documentation.

http://cookbook.fortinet.com/hub-and-spoke-vpn-using-quick-mode-selectors/

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/hub-and-spoke.115.01.html

Answer 2

Assuming you have set up the VPNs in interface mode (a.k.a. route-based), you need 2 things for this to work:

1- two routes to the other 2 networks 2- policies to allow the traffic

Let's call the 3 sites A,B,C and the firewall FGT.

If A can ping B, and B can ping C then you already have a route to network B in FGT A, and a route to network C in FGT B. You also have return routes in place, on FGT B to network A and network C. Reversing the traffic: if you can ping from B to A, and from C to B then you have 2 policies on each FGT.

The key point for the necessary additions to your routes and policies to enable traffic from A to C is that the FGTs will drop traffic from "unknown" sources, that is, from networks they don't have a route to.

FGT A doesn't "know" about network C, and vice versa. So you need an additional route on FGT A to network C pointing to the tunnel interface to FGT B (the only tunnel interface here), and also one more route on FGT C to network A pointing to the (only) tunnel interface.

Then you have to add network C to both policies on FGT A (as destination and as source, respectively). The same applies to FGT C, allowing network A in the policies.

This does sound like a lot of effort for a WAN network with only 3 nodes. Having 4, 5,... nodes in between creates a substantial amount of configuration needs UNLESS you design your networks in a suitable manner.

If all networks behind the firewalls could be supernetted then policies and routes only have to be created once. Example: create networks A,B,C as 10.121.1.0/24, 10.121.2.0/24, 10.121.3.0/24. The only route needed on any FGT would be 10.121.0.0/16, and in the only 2 policies needed on any FGT you would have one destination 10.121.0.0/16 and one source 10.121.0.0/16. That's how hub-and-spoke VPNs are set up ideally.

Answer 3

You should configure a full mesh VPN so that spoke to spoke traffic does not have to hairpin the main site. In other words, configure a VPN between the branch sites.