Fortinet Route Based VPN with overlapping Networks

The other day I needed to establish an IPSEC VPN on a Fortinet 60D with Source NAT for an overlapping Subnet scenario. The remote subnet was the same as our local one.

I only found Policy Based examples in the Fortinet kb, so I tested it myself using a route based VPN.

The trick is to create an IP-Pool with the source NAT Subnet range, e.g. 192.168.99.0/24
This subnet is then presented to the remote IPSEC VPN (Proxy-ID) during IPSEC Phase 2 negotiation.

Whenever you access remote resources via the VPN, your local subnet IP (e.g. 192.168.1.2) is translated 1:1 into the IP-Pool subnet address (192.168.99.1) before entering the VPN.

1. create a IP Pool (Policy & Objects > IP Pools > Create New) with the following settings:

• Type: Overload
• Range: 192.168.99.0 - 192.168.99.255
• ARP Reply: checked

2. Create your route based VPN (e.g. using the wizard). Type is "custom".

In Phase2:

• Use your IP-Pool Subnet address (the source NAT translated one created in 1.)
• Add all remote Subnets needed as Proxy-IDs. 

3. Add static routes for all remote subnets (Network > Static Routes):

• Destination: Subnet
• Subnet specification, e.g. 192.168.243.0/24
• Device: <Tunnel Interface for the VPN>
• Administative Distance: 10

4. Create Address Entries for local and remote subnets. If you use the VPN wizard, these entries are created automatically. If you configure the VPN manually or on the CLI, you must create address book entries on your own:

• Create one entry for your local internal network, e.g: 192.168.1.0/24
• Create entries for all remote subnets

5. Create a policy (Policy & Objects > IPv4 Policy > Create New:

• Incoming Interface: internal
• Outgoing Interface: <Tunnel Interface for the VPN>
• Source: <Your local internal network Address entry created in 4.>
• Destination Address: <remote network address definition(s) created in 4.>
• Schedule: always
• Service: ALL
• Action: ACCEPT
• NAT: enable
• Fixed Port: disable
• IP Pool Configuration: "Use Dynamic IP Pool". Select your Source-NAT IP Pool defined in 1.
• Enable this policy: enabled

6. Test your communication to the remote subnet(s).