Site A needs IPsec with site B. Site A networks 192.168.20.0/24 and 192.168.50.0/24 need to reach Site B network 192.168.1.0/24. And the other way around as well. The problem is that Site A has a network 192.168.1.0/24 on its LAN interface, and a route to it as well. I can only modify Site A configuration. I have to somehow apply NAT on site B 192.168.1.0/24, so that computers on site A use one-to-one NAT 192.168.250.0/24 to reach remote 192.168.1.0/24. 192.168.250.1 is used to access 192.168.1.1 and etc. Just before the traffic is sent, the destination NAT is performed from 192.168.250.1 to 192.168.1.1, etc... And when traffic is received, source NAT is used to translate 192.168.1.1 to 192.168.250.1, etc...
My first idea was to implement it as follows:
config firewall vip
edit "SiteB_NAT"
set extip 192.168.250.0-192.168.250.255
set mappedip "192.168.1.0-192.168.1.255"
set extintf "any"
next
end
config firewall ippool
edit "SNAT_SiteB"
set type one-to-one
set startip 192.168.250.0
set endip 192.168.250.255
next
end
end
config firewall policy
edit 53
set name "To_SiteB"
set srcintf "BNET_L2" "VLAN50"
set dstintf "IPSec_VGGN"
set action accept
set srcaddr "192.168.20.0/24" "192.168.50.0/24"
set dstaddr "SiteB_NAT"
set schedule "always"
set service "ALL"
set logtraffic all
next
end
config firewall policy
edit 55
set name "From_VGGN"
set srcintf "IPSec_VGGN"
set dstintf "BNET_L2" "VLAN50"
set action accept
set srcaddr "192.168.1.0/24"
set dstaddr "192.168.20.0/24" "192.168.50.0/24"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set ippool enable
set poolname "SNAT_SiteB"
set comments "From_VGGN"
next
end
But then there is a problem, Fortigate first applies policy, then routing. So it would still look for a route to 192.168.1.0/24, and it would forward it to LAN interface, right? How to overcome this, maybe somehow it's possible to make a route only for policy 53? Or maybe there is a different, better solution for this problem (I cannot modify subnet on SiteB)?
