3

I'm trying to create IPsec VPN Tunnel between two sites.

Site 1
Fortigate 140D
Local subnet : 192.168.1.0/24

Site 2
Fortigate 100D
Local Subnet : 192.168.2.0/24

But when I try to create it, it gives me the error: Conflicts with existing local subnet(s)

I don't understand why... can anyone explain it to me? What I have to do?

enter image description here

  • 1
    You should check Policy&Objects -> Objects -> Addresses – ALex_hha Mar 15 '16 at 10:43
  • This question cannot be answered without knowing all the subnets used in both site1 and site2. – Tero Kilkanen Mar 17 '16 at 13:38
  • Site 1 have only 1 subnet on the fortinet 192.168.1.0/24 and Site2 have only 1 subnet also 192.168.2.0/24 @TeroKilkanen – Adeel ASIF Mar 17 '16 at 13:39
  • And there are no other IP networks in neither site? – Tero Kilkanen Mar 17 '16 at 13:47
3
+150

By default Fortigate firewall's dedicated management interface has an IP address from 192.168.1.0/24 range. Please note, it is not the internal interface, it's another dedicated port for management, with default ip 192.168.1.99. You can connect to the firewall directly with this interface using an ip address 192.168.1.2 and subnet 255.255.255.0.

I guess, this default setting of the firewall is the reason of the conflict. You can investigate this yourself and find it out. Either you will need to change the management ip range or the remote network ip range for the vpn to work.

| improve this answer | |
  • That sounds right to me. I just use plain OpenVPN on a server of my own creation, but the subnet thing can crop up just the same. OpenVPN requires a subnet of its own (in route mode) so clients can be assigned an IP on the VPN. This subnet (the management interface in your answer probably) can conflict with one of the subnets on the client side, making routing impossible. – MrMajestyk Mar 18 '16 at 9:13
  • Yessssss !!! That's it! Problem solved. – Adeel ASIF Mar 18 '16 at 12:39
3

This warning is telling you that your configuration would result in an IP address space collision. The 192.168.1.0/24 subnet that you're trying to connect to remotely already exists locally.

You can't have the same IP address space in two different places on your WAN, so you need to either change the remote subnet to something that doesn't exist locally, or remove the 192.168.1.0/24 subnet from the local network.

| improve this answer | |
  • Can you give me some example of compatible subnet? I can easily change the site2 subnet... – Adeel ASIF Mar 15 '16 at 9:33
  • @AdeelASIF Not without knowing your network, no. Your local subnet needs to only exist at the local site, and your remote subnet needs to only exist at your remote site. – HopelessN00b Mar 15 '16 at 9:37
  • Can you explain why 192.168.1.0 and 192.168.2.0 are same subnet? I dont really understand – Adeel ASIF Mar 15 '16 at 9:50
  • 1
    @AdeelASIF They're not the same subnet. You just... you should hire or contract a network engineer to sort this out for you. – HopelessN00b Mar 15 '16 at 9:54
0

Even though the subnets 192.168.1.0/24 and 192.168.2.0/24 are different, the device at 192.168.2.254 thinks that 192.168.1.0/24 conflicts with the local subnet.

Perhaps the device at 192.168.2.254 is actually using a netmask of 255.255.252.0 which would be a /22 and have an IP range of 192.168.0.0 - 192.168.3.255

In either case, it appears that you are trying to have a site-to-site IPsec VPN with overlapping subnets. Fortinet has a document describing how to accomplish Site-to-site IPsec VPN with overlapping subnets.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.