3

I need to communicate for three sites through vpn. For below scenario,

enter image description here

is possible to reach 10.33.209.xx/27 from 192.168.60.xx.

please give any idea to communicate in three segment.

  • You need to edit you question to include what make/models of network equipment and configurations you have, and what doesn't seem to be working. – Ron Maupin Jan 5 '16 at 3:59
  • Hi Ron Maupin, there is fortinet firewalls, the configuration details are from spoke: .edit "Corp-Airtel" set interface "wan2" set mode aggressive set proposal 3des-sha1 set remote-gw xxx.xx.xx.x set psksecret En next edit "Corp-Airtel2" set keepalive enable set pfs disable set phase1name "Corp-Airtel" set proposal 3des-sha1 set dst-subnet 10.200.0.0 255.255.0.0 set src-subnet 192.168.60.0 255.255.255.0 – Karthick Whitey Jan 5 '16 at 4:27
  • 10.200.2.xx firewall config:edit "Spoke" set interface "wan2" set mode aggressive set proposal 3des-sha1 set remote-gw xxx.xx.xx.x set psksecret En next edit "Spoke-Phase2" set keepalive enable set pfs disable set phase1name "Corp-Airtel" set proposal 3des-sha1 set dst-subnet 192.168.60.0 255.255.255.0 set src-subnet 10.200.0.0 255.255.0.0 – Karthick Whitey Jan 5 '16 at 4:28
  • Now i i will reach the server (10.33.209.xx) from 192.168.60.xx via 10.200.2.xx..... Did you understand my issue – Karthick Whitey Jan 5 '16 at 4:31
  • we can communicate 10.33.209.xx to 10.200.2.xx – Karthick Whitey Jan 5 '16 at 4:32
1

This is a so called hub and spoke configuration, if you are using Fortigate appliances, then you can follow this documentation.

http://cookbook.fortinet.com/hub-and-spoke-vpn-using-quick-mode-selectors/

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/hub-and-spoke.115.01.html

| improve this answer | |
  • Thanks for your suggestions, I just allowed the policy on each zone after that its working. – Karthick Whitey Jan 3 '17 at 11:50
0

Assuming you have set up the VPNs in interface mode (a.k.a. route-based), you need 2 things for this to work:

1- two routes to the other 2 networks 2- policies to allow the traffic

Let's call the 3 sites A,B,C and the firewall FGT.

If A can ping B, and B can ping C then you already have a route to network B in FGT A, and a route to network C in FGT B. You also have return routes in place, on FGT B to network A and network C. Reversing the traffic: if you can ping from B to A, and from C to B then you have 2 policies on each FGT.

The key point for the necessary additions to your routes and policies to enable traffic from A to C is that the FGTs will drop traffic from "unknown" sources, that is, from networks they don't have a route to.

FGT A doesn't "know" about network C, and vice versa. So you need an additional route on FGT A to network C pointing to the tunnel interface to FGT B (the only tunnel interface here), and also one more route on FGT C to network A pointing to the (only) tunnel interface.

Then you have to add network C to both policies on FGT A (as destination and as source, respectively). The same applies to FGT C, allowing network A in the policies.

This does sound like a lot of effort for a WAN network with only 3 nodes. Having 4, 5,... nodes in between creates a substantial amount of configuration needs UNLESS you design your networks in a suitable manner.

If all networks behind the firewalls could be supernetted then policies and routes only have to be created once. Example: create networks A,B,C as 10.121.1.0/24, 10.121.2.0/24, 10.121.3.0/24. The only route needed on any FGT would be 10.121.0.0/16, and in the only 2 policies needed on any FGT you would have one destination 10.121.0.0/16 and one source 10.121.0.0/16. That's how hub-and-spoke VPNs are set up ideally.

| improve this answer | |
0

You should configure a full mesh VPN so that spoke to spoke traffic does not have to hairpin the main site. In other words, configure a VPN between the branch sites.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.