Connecting VPN to VPN to VPN

Question

So we have a Fortigate that sits at our head end. And it has a connection to Azure,

I then i have an IPsec tunnel for people who want to connect to our sites remotely, this works perfectly, they can see all resources at our sites, until you try and access Azure resources. So i am looking to connect from home to fortigate via ip sec, then to azure via the site to site vpn we have.

Answer 1

@Travis Eddingfield

Thank you for reaching out.

I understand it correctly you have a FortiGate at your on-prem that connects to Azure using site-site VPN. You also have an IPsec tunnel for remote access to your sites. Everything works fine, except for accessing Azure resources from home. You want to connect from home to FortiGate via IPsec, then to Azure via the site-to-site VPN you have.

Before we proceed to troubleshooting steps.

For the requirements above, we have seen customers usually implement the network design in the following manner.

Where the users at home connect to Azure using Point-2-Site VPN and are able to access both Azure as well as on-prem resources. This scenario is explained briefly here.

You can refer to this scenario to help with routing.

If the architecture above does not satisfy your requirements, you can follow the troubleshooting steps below in order to pin-point the issue.

• Check the routes learned by the Azure VPN gateway and see if the expected routes are present. If there is a VM present on Azure VNET then you can also check the effective routes as shown here and see if the routes are propagated correctly
• Configure packet capture for your Azure VPN Gateway in order to determine if packets are received by the VPN Gateway. You can also perform a packet capture on your FortiGate firewall to determine if this is an on-prem issue.
• Validate if there are no overlapping IP addresses used.

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.