I have 4 sites running ipsec vpn on a fortigate 30E as below:

Site A (HQ)
Site B (Branch1)
Site C (Branch2)
Site D (Branch3)

The connection is made from branches (B,C,D) to HQ (A) and is working fine. But I cannot call between branches. I need to forward traffic through HQ. for example ping from (B) to (C) over HQ

  • You need to tell the branch routers how to reach the other branch networks, either with a routing protocol common to all, or by using static routes. This is really just basic routing.
    – Ron Maupin
    Jul 29, 2021 at 13:56
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 23, 2021 at 21:03

1 Answer 1


There are a few configuration details to consider:

  • Each branch gateway requires not only the HQ network in its IPsec SAs, but also those of the other branches. Finer graning is (somewhat) more secure but harder to maintain than e.g. use in whole, depending on your addressing.
  • The branch gateways also require routes to the other branches via the HQ. As before, you could just use an aggregated route like -> HQ, or use a routing protocol like OSPF.
  • Each gateway requires firewall rules to permit traffic in from and out to the other gateway(s) for the entire address range.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.