Can't access Fortigate through VPN

Forum|Forum|10 years ago
April 14, 2016
6 replies
14606 views

Hello,

We have 4 Fortigates (5.2.7) on one network.

Each has a public IP, but for security reasons I want that we can only access them through a VPN.

So I set up an IPSec Dialup VPN. It works fine with FortiClient on Mac.

Then I put a FW rule to access each of the devices on the internal IP (10.x.x.1-10.x.x.4) on ALL services and doing NAT, so each FW don't need to know that 192.168.1.x (IP of the clients connected) is behind FW 1.

I can do SSH and ping with no problems.

Anyhow I can't access the devices through HTTPS (I change HTTPS to port 4443), it doesn't load properly.

Sometimes I can see the login page, other I get a timeout, others loads badly, etc.

"diagnose debug flow trace" show the traffic flows normally.

Any idea what can it be?

Thanks!

5.2

emnoc

New Member

So you ran diag debug flow and it shows no problems? I would double check the service-port and allowaccess.

With sslvpn you can enable ssl.root interface with "set allowaccess ssh icmp snmp https" for example. If you have this set, unset it and re-apply in fortiOS 5.0.xx we ran into issues with set allowaccess not working as expect and it required a reset.

Also, In a dialupvpn interface mode, you will do the same thing but on the exatc dialup interface. Also I would run a diag sniffer packer <interface name> " port 443 or 4443" and see if the tcp SYN is being received.

Lastly, make sure any set trusthost allows for the dialup ipsec ipv4 pool address ranges

JohnAgoraAuthor

New Member

Hello,

Allowaccess is properly configured since I can access sometimes (and I've double check it) to the devices.

The VPNs are IPSec.

What I don't get to understand is why SSH and ping works fine.

But HTTPS sometimes works poorly (bad GUI, very slow), sometimes it just don't work and very very rarely it works fine.

The Internet connections is stable.

Are there any know bugs that affect like this? (I haven't found any).

Thanks!

emnoc

New Member

Could be TCP/MSS issues since you ssh works fine.

Sign up

Login with SSO

Login to the community

Login with SSO