Configuring Ipsec Virtual Ip Addresses - Fortinet FortiGate FortiGate-60M Administration Manual

CLI configuration
276
Note: Typing next lets you define another VIP address without leaving the vip shell.
This example shows how to display the settings for the vpn ipsec vip command.
get vpn ipsec vip
This example shows how to display the settings for the VIP entry named 1.
get vpn ipsec vip 1
This example shows how to display the current configuration of all existing VIP
entries.
show vpn ipsec vip

Configuring IPSec virtual IP addresses

Use the FortiGate unit's IPSec VIP feature to enable hosts on physically different
networks to communicate with each other as if they were connected to the same
private network. This feature can be configured manually through CLI commands.
When the destination IP address in a local ARP request matches an entry in the
FortiGate unit's virtual IP (VIP) table, the FortiGate unit responds with its own MAC
address and forwards traffic to the correct destination at the other end of the VPN
tunnel afterward.
Consider the following example, which shows two physically separate networks. The
IP addresses of the computers on both networks are in the 192.168.12.0/24 range,
but no two IP addresses are the same. An IPSec VPN has been configured between
FortiGate_1 and FortiGate_2. The FortiGate configuration permits Host_1 on the
Finance network to transmit data to Host_2 on the HR network through the IPSec
VPN tunnel.
Figure 142:A typical site-to-site configuration using the IPSec VIP feature
FortiGate_1
external
Esc Enter
Finance Network
192.168.12.0/24
01-28007-0144-20041217
Internet
Host_1
192.168.12.1
HR Network
192.168.12.0/24
Host_2
192.168.12.2
external
FortiGate_2
VPN
Esc Enter
Fortinet Inc.