1

I have 4 sites running ipsec vpn on a fortigate 30E as below:

Site A (HQ)
Site B (Branch1)
Site C (Branch2)
Site D (Branch3)

The connection is made from branches (B,C,D) to HQ (A) and is working fine. But I cannot call between branches. I need to forward traffic through HQ. for example ping from (B) to (C) over HQ

Improve this question
2
  • You need to tell the branch routers how to reach the other branch networks, either with a routing protocol common to all, or by using static routes. This is really just basic routing.
    – Ron Maupin ♦
    Jul 29, 2021 at 13:56
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 23, 2021 at 21:03

1 Answer 1

Reset to default
3

There are a few configuration details to consider:

  • Each branch gateway requires not only the HQ network in its IPsec SAs, but also those of the other branches. Finer graning is (somewhat) more secure but harder to maintain than e.g. use 10.0.0.0/8 in whole, depending on your addressing.
  • The branch gateways also require routes to the other branches via the HQ. As before, you could just use an aggregated route like 10.0.0.0/8 -> HQ, or use a routing protocol like OSPF.
  • Each gateway requires firewall rules to permit traffic in from and out to the other gateway(s) for the entire address range.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.