Troubleshooting Tip: IPsec Dial-up VPN over VIP to access the specific websites

Description

This article describes how to troubleshoot an issue with traffic flow from IPsec over a VIP configuration.

Scope

FortiGate.

Solution

Once the configuration is set up, run the following command in the CLI to verify the VIP address configured on IP-POOL:

diagnose debug flow filter addr x.x.x.x
diagnose debug flow show function-name enable
diagnose debug flow show iprope enable
diagnose debug flow trace start 999
diagnose debug enable 

Use the debug log outputs to verify the policy (IPsec to LAN) and the IP pool, and whether or not the VIP is added on the multiple policies with the outgoing 'WAN Interface'.

Check if the WAN interface is associated with VIP policy or not, then specify the IPsec Interface instead of the WAN Interface on the IP pool.

Change from the WAN interface to a specific IPsec dial-up interface on the IP pool; and make the same change on the policy. Next, disconnect the FortiClient VPN and re-connect it. Once the VPN is connected, the specific URL will be accessible.

Note:
If the IPsec dial-up VPN is not connecting through the same WAN interface configured in the VIP profile with any-to-any ports, specify the required port for the VIP traffic and clear the existing sessions associated with the WAN interface.

After completing these steps, reconnect the FortiClient VPN. The VPN connection should then be established successfully.