Channel mode configuring subnet overlapping IPSec VPN

This document describes the configuration of subnet overlapping IPSec VPN for all fortigate devices. When you configure VPN interconnection, you need to use NAT for address translation if the subnets on both ends overlap but cannot change any one end of the network to allow VPN connectivity. It is not recommended to use overlapping addresses at both ends of the VPN.

Environment Introduction:

This article uses fortigate500a, fortigate310b to do the demo. The system version supported in this article is Fortios v3.0 MR3 or higher.

Topology Description:

FORTIGATE500A: Local network, 192.168.4.0/24, End-to-end network, 192.168.66.0/24

Backend Nat Post network: 192.168.65.0/24

FORTIGATE310B: Local network, 192.168.4.0/24, End-to-end network, 192.168.65.0/24

Backend Nat Post network: 192.168.66.0/24

The following 500A configuration, 310B is basically the same, only on the network address and 500A corresponding.

Step One: Configure IPSec Phase One

Create phase one in virtual private network----IPSEC----IKE

IP Address: IP interface to the end extranet

Pre-shared key authentication mode

Enable NAT Traverse