I need to communicate for three sites through vpn. For below scenario,
is possible to reach 10.33.209.xx/27 from 192.168.60.xx.
please give any idea to communicate in three segment.
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
This is a so called hub and spoke configuration, if you are using Fortigate appliances, then you can follow this documentation.
Assuming you have set up the VPNs in interface mode (a.k.a. route-based), you need 2 things for this to work:
1- two routes to the other 2 networks 2- policies to allow the traffic
Let's call the 3 sites A,B,C and the firewall FGT.
If A can ping B, and B can ping C then you already have a route to network B in FGT A, and a route to network C in FGT B. You also have return routes in place, on FGT B to network A and network C. Reversing the traffic: if you can ping from B to A, and from C to B then you have 2 policies on each FGT.
The key point for the necessary additions to your routes and policies to enable traffic from A to C is that the FGTs will drop traffic from "unknown" sources, that is, from networks they don't have a route to.
FGT A doesn't "know" about network C, and vice versa. So you need an additional route on FGT A to network C pointing to the tunnel interface to FGT B (the only tunnel interface here), and also one more route on FGT C to network A pointing to the (only) tunnel interface.
Then you have to add network C to both policies on FGT A (as destination and as source, respectively). The same applies to FGT C, allowing network A in the policies.
This does sound like a lot of effort for a WAN network with only 3 nodes. Having 4, 5,... nodes in between creates a substantial amount of configuration needs UNLESS you design your networks in a suitable manner.
If all networks behind the firewalls could be supernetted then policies and routes only have to be created once. Example: create networks A,B,C as 10.121.1.0/24, 10.121.2.0/24, 10.121.3.0/24. The only route needed on any FGT would be 10.121.0.0/16, and in the only 2 policies needed on any FGT you would have one destination 10.121.0.0/16 and one source 10.121.0.0/16. That's how hub-and-spoke VPNs are set up ideally.