configuration VPN SSL

Forum|Forum|2 years ago
January 24, 2024
2 replies
3229 views

friends a question:
Is it possible to configure a VPN client with the feature that they must browse the Internet with the public IP of the office?
In my FW the SSL VPN is already configured, what I did was create a portal, then create the policy as shown in the image below. But when I test the connection to the VPN I lose my internet

dbu

Staff

Hi @unknown1020
Have you enabled NAT on the firewall policy ?

unknown1020Author

Explorer III

Hello, I already enabled the NAT policy and it works on my PC, that is, when I connect I do have internet. One question, how do I know that I am browsing with the office's public IP?

Would it be in this option?

mpftnt

Staff

Hi @unknown1020 .

If you want to allow internet traffic of users to pass through your office FortiGate, you need to disable split tunneling. You must configure two policies: SSLVPN to Internal Interface and SSLVPN to WAN interface. You may refer to the following links:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-Split-Tunnel-configuration/ta-p/198692

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disable-split-tunneling-to-specific-groups-and/ta-p/262812

Regards,

MP

unknown1020Author

Explorer III

that's OK?

One question, how do I know that I am browsing with the office's public IP?

Would it be in this option?

mpftnt

Staff

Hi @unknown1020

Basic checks that I would do are the following:

1. Check forward traffic logs will show that it matches the policy for SSLVPN to WAN
2. Check whatsmyip from your browser. You should be getting Fortigate's public IP address.
3. Trace route from PC
4. Run sniffer/debug on FortiGate.
5. Check session:

diag sys session filter <source IP address>
dia sys session list

Regards,

MP

Sign up

Login with SSO

Login to the community

Login with SSO